An OS command injection flaw in the usbinteract.cgi script of EnGenius EnShare Cloud Service allows attackers to insert crafted commands into the "path" parameter. The input is not sanitized, so the underlying shell accepts the payload and executes it with root privileges. As a result, an unauthenticated remote actor can run arbitrary code and fully compromise the device.

The vulnerability affects EnGenius EnShare IoT Gigabit Cloud Service on firmware versions 1.4.11 and earlier. This includes the hardware models epg5000, esr1200, esr1750, esr300, esr350, esr600, and esr900 running any firmware version up to the stated limits. Any unit in this line that has not been upgraded beyond version 1.4.11 remains vulnerable.

The CVSS base score of 10 indicates complete system compromise, and the EPSS score of 10% shows that exploitation is considered likely in the environment. While the vulnerability is not listed in the CISA KEV catalog, real‑world exploitation was observed by the Shadowserver Foundation on 2024‑12‑05, underscoring the urgency. Attackers can reach the exposed endpoint over the network without authentication, so exposure to the Internet or an unrestricted management network can enable exploitation.