Weakness (CWE)
CWE-77: Command Injection
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
More detail
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
How to prevent it (5 mitigations)
-
Architecture and Design
If at all possible, use library calls rather than external processes to recreate the desired functionality.
-
Implementation
If possible, ensure that all external commands called from the program are statically created.
-
Implementation
Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
-
Operation
Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
-
System Configuration
Assign permissions that prevent the user from accessing/opening privileged files.
Source: MITRE CWE-77
3,210 results · Feed
-
Critical 9.1CVE-2024-39360 EPSS 12%
An os command injection vulnerability exists in the nas.cgi remove_dir() functionality of Wavlink AC3000 M33A8.V5030.21…
-
High 7.8
exelban stats XPC Service shouldAcceptNewConnection command injection
A vulnerability, which was classified as critical, has been found in exelban stats up to 2.11.21. This issue affects the function shouldAcceptNewConnection of the component XPC Service. The manipulation leads to command injection. It is possible to launch the…
-
Medium 6.3
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the ap…
-
High 8.0
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the ap…
-
High 8.0
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif…
-
Critical 9.8
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the ap…
-
High 8.0
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the modifyOne par…
-
Medium 6.3
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the newpasswd par…
-
High 8.0
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the iface parameter in the vif…
-
Critical 9.8
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the r…
-
Medium 6.3
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the devname param…
-
Medium 5.1
TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the opmode parame…
-
Critical 9.8
Linksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the ap…
-
Critical 9.8
Tenda ac9 v1.0 firmware v15.03.05.19 is vulnerable to command injection in /goform/SetSambaCfg, which may lead to remot…
-
High 7.3
KaiYuanTong ECT Platform HTTP POST Request runCode.php command injection
A vulnerability, which was classified as critical, has been found in KaiYuanTong ECT Platform up to 2.0.0. Affected by this issue is some unknown functionality of the file /public/server/runCode.php of the component HTTP POST Request Handler. The manipulation…
-
High 8.1
Due to the improper handling of batch files in child_process.spawn / child_process.spawnSync, a malicious command line …
-
Medium 6.4
Composio Command Execution vulnerability
composio >=0.5.40 is vulnerable to Command Execution in composio_openai, composio_claude, and composio_julep via the handle_tool_calls function.
-
High 8.8CVE-2024-51442 Public exploit
Command Injection in Minidlna version v1.3.3 and before allows an attacker to execute arbitrary OS commands via a speci…
-
High 7.2
Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge
Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execut…
-
High 7.2
Authenticated Remote Command Injection Vulnerability in the Web Interface of a 501 Wireless Client Bridge
Multiple command injection vulnerabilities exist in the web interface of the 501 Wireless Client Bridge which could lead to authenticated remote command execution. Successful exploitation of these vulnerabilities result in the ability of an attacker to execut…
-
Critical 9.8
A vulnerability exits in driver SmSerl64.sys in Motorola SM56 Modem WDM Driver v6.12.23.0, which allows low-privileged …
-
High 8.8CVE-2024-13129 EPSS 18%
Roxy-WI roxy.py action_service os command injection
A vulnerability was found in Roxy-WI up to 8.1.3. It has been declared as critical. Affected by this vulnerability is the function action_service of the file app/modules/roxywi/roxy.py. The manipulation of the argument action/service leads to os command injec…
-
High 7.2
An unintended entry point vulnerability has been identified in certain router models, which may allow for arbitrary com…
-
High 7.2CVE-2024-12912 Public exploit
An improper input insertion vulnerability in AiCloud on certain router models may lead to arbitrary command execution. …
-
High 7.3
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupload os command injection
A vulnerability, which was classified as critical, was found in DrayTek Vigor2960 and Vigor300B 1.5.1.4. Affected is an unknown function of the file /cgi-bin/mainfunction.cgi/apmcfgupload of the component Web Management Interface. The manipulation of the argu…
KEV May 15, 2025 -
High 7.3
DrayTek Vigor2960/Vigor300B Web Management Interface apmcfgupptim os command injection
A vulnerability, which was classified as critical, has been found in DrayTek Vigor2960 and Vigor300B 1.5.1.3/1.5.1.4. This issue affects some unknown processing of the file /cgi-bin/mainfunction.cgi/apmcfgupptim of the component Web Management Interface. The …
-
Medium 6.3
Overtek OT-E801G passwd os command injection
A vulnerability classified as critical was found in Overtek OT-E801G OTE801G65.1.1.0. This vulnerability affects unknown code of the file /diag_ping.cmd?action=test&interface=ppp0.1&ipaddr=8.8.8.8%26%26cat%20/etc/passwd&ipversion=4&sessionKey=test. The manipu…
-
High 7.8
MGOS Command Injection
A command injection is possible through the user interface, allowing arbitrary command execution as the root user. oMG2000 running MGOS 3.15.1 or earlier is affected. MG90 running MGOS 4.2.1 or earlier is affected.
-
Critical 9.8
There is a command injection vulnerability in Huawei terminal printer product. Successful exploitation could result in …
-
High 8.0
Potential LDAP injection vulnerability in OpenText Privileged Access Manager
In a specific scenario a LDAP user can abuse the authentication process using injection attack in OpenText Privileged Access Manager that allows authentication bypass. This issue affects Privileged Access Manager version 23.3(4.4); 24.3(4.5)
-
Medium 5.5
QuFirewall
A command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow remote attackers who have gained administrator access to execute arbitrary commands. We have already fixed the vu…
-
Critical 9.8
SeaCMS <=13.0 is vulnerable to command execution in phome.php via the function Ebak_RepPathFiletext().
-
High 8.8
In ThreatQuotient ThreatQ before 5.29.3, authenticated users are able to execute arbitrary commands by sending a crafte…
-
Critical 9.8
Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
KEV Dec 19, 2024 -
High 7.3
Databricks JDBC Driver Command Injection vulnerability
Databricks JDBC Driver 2.x before 2.6.40 could potentially allow remote code execution (RCE) by triggering a JNDI injection via a JDBC URL parameter. The vulnerability is rooted in the improper handling of the krbJAASFile parameter. An attacker could potentia…
-
Medium 5.9
An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while querying Search Templat…
-
High 7.1
An issue was discovered in Logpoint UniversalNormalizer before 5.7.0. Authenticated users can inject payloads while cre…
-
Medium 5.9
An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads while creating Search Templat…
-
High 7.1
An issue was discovered in Logpoint before 7.5.0. Authenticated users can inject payloads in Report Templates. These ar…
-
Critical 9.8
In Cleo Harmony before 5.8.0.24, VLTrader before 5.8.0.24, and LexiCom before 5.8.0.24, an unauthenticated user can imp…
KEV Dec 17, 2024