EnGenius recently posted a security update announcing the release of firmware v1.2.107 to address the critical PHP2Shell vulnerabilities affecting its ESG320, ESG510, ESG610, and ESG620 security gateways. If you manage one of these models, update its firmware through the EnGenius Cloud portal as soon as possible.
The fixed firmware became available on October 23, 2026. According to EnGenius, the EnGenius Cloud service and all other EnGenius products are not affected by these vulnerabilities.
Affected models and fixed firmware
| Model |
Fixed firmware |
Release date |
| ESG320 |
v1.2.107 |
October 23, 2026 |
| ESG510 |
v1.2.107 |
October 23, 2026 |
| ESG610 |
v1.2.107 |
October 23, 2026 |
| ESG620 |
v1.2.107 |
October 23, 2026 |
Why this update matters
PHP2Shell refers to two vulnerabilities in the PHP engine, identified as CVE-2026-109618 and CVE-2026-109619. EnGenius rates them Critical, with a CVSS v4.0 base score of 9.2. The affected ESG gateways use PHP for their web management interface.
An attacker who can reach an affected device’s web management interface could execute code remotely without logging in. At the time of its advisory’s publication, EnGenius reported that it was not aware of malicious use of these vulnerabilities against EnGenius products.
Update your ESG gateways
Review the ESG gateways you manage, including devices at customer sites, and install firmware v1.2.107 through the EnGenius Cloud portal. After the upgrade, verify that each gateway is running the fixed firmware.
If you previously disabled Captive Portal, SecuPoint Client VPN, or local web management as a workaround, EnGenius says you can re-enable those features after upgrading.
Temporary workarounds if you cannot upgrade immediately
Until the fixed firmware is installed, EnGenius recommends disabling the following features in the EnGenius Cloud portal to remove the exposed attack surface:
- Captive Portal: Go to Gateway → LAN (VLAN interfaces) → Captive Portal and set it to disabled.
- SecuPoint Client VPN: Go to Gateway → Client VPN → SecuPoint and set it to disabled.
- Local web management: Go to General Settings → Network → Local Web Pages Access Control and set Local web page to disabled.
These workarounds turn off the corresponding captive portal, client VPN, and local administration features. Coordinate the change with anyone who depends on those services. Installing the fixed firmware lets you restore those features while addressing the vulnerabilities.
Read the official advisory
EnGenius PHP2Shell security advisory · EnGenius support
Streakwave encourages customers and partners using the affected ESG models to prioritize this firmware update. Refer to the official advisory for the latest status and contact EnGenius support if you need help applying the update.
Information verified against the EnGenius advisory on October 23, 2026.