An OS command injection flaw exists in the usbinteract.cgi script of EnGenius EnShare Cloud Service. The script fails to sanitize the "path" parameter, allowing a crafted payload to be passed to the operating system shell. When executed, the payload runs with root privileges, giving an attacker full control over the device. The vulnerability requires no authentication and can be triggered remotely through the exposed web endpoint.

The flaw affects EnGenius EnShare IoT Gigabit Cloud Service on firmware versions 1.4.11 and earlier. This includes hardware models epg5000, esr1200, esr1750, esr300, esr350, esr600, and esr900 running any firmware version up to the stated limits. Any unit that has not been upgraded beyond 1.4.11 remains vulnerable.

The CVSS base score of 10 highlights the potential for complete system compromise. The EPSS score of 25% indicates that exploitation is considered likely. The vulnerability is not listed in the CISA KEV catalog, but real‑world exploitation was observed by the Shadowserver Foundation on 2024‑12‑05, underscoring its urgency. The likely attack vector is an unauthenticated remote request to the usbinteract.cgi endpoint over the network. Based on the description, it is inferred that an attacker can inject arbitrary commands via the "path" parameter and execute them with root privileges, enabling full device takeover.