CVE-2024-45242

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

EnGenius ENH1350EXT A8J-ENH1350EXT devices through 3.9.3.2_c1.9.51 allow (blind) OS Command Injection via shell metacharacters to the Ping or Speed Test utility. During the time of initial setup, the device creates an open unsecured network whose admin panel is configured with the default credentials of admin/admin. An unauthorized attacker in proximity to the Wi-Fi network can exploit this window of time to execute arbitrary OS commands with root-level permissions.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

No affected versions have been published.

Timeline

Published: Oct 24, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-452445.3Hyperledger Fabric through 3.0.0 and 2.5.x through 2.5.9 do not verify that a request has a timestamp within the expected time window.CVE-2024-452457.8Diebold Nixdorf – CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-452467.3Diebold Nixdorf – CWE-427: Uncontrolled Search Path Element CVE-2024-452476.1Sonarr – CWE-601: URL Redirection to Untrusted Site ('Open Redirect')CVE-2024-452487.5Multi-DNC – CWE-35: Path Traversal: '.../...//'CVE-2024-452499.8Cavok – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2024-45256.1A vulnerability has been found in Campcodes Complete Web-Based School Management System 1.0 and classified as problematic. This vulnerabilit CVE-2024-452504.3ZKteco – CWE 200 Exposure of Sensitive Information to an Unauthorized Actor CVE-2024-452519.8Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-452529.8Elsight – CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')CVE-2024-452537.5Avigilon – CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')CVE-2024-452547.5VaeMendis - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')