Skip to content
OpenAdvisories

Weakness (CWE)

CWE-77: Command Injection

Class Draft Improper Neutralization of Special Elements used in a Command

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

More detail

Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.

How to prevent it (5 mitigations)

  1. Architecture and Design

    If at all possible, use library calls rather than external processes to recreate the desired functionality.

  2. Implementation

    If possible, ensure that all external commands called from the program are statically created.

  3. Implementation

    Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.

    When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."

    Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.

  4. Operation

    Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.

  5. System Configuration

    Assign permissions that prevent the user from accessing/opening privileged files.

Source: MITRE CWE-77

All Critical High Medium Low Exploited only Public exploit

3,210 results · Feed

  • High 8.0
    CVE-2024-44400 EPSS 14%

    A vulnerability was discovered in DI_8400-16.07.26A1, which has been classified as critical. This issue affects the upg…

  • High 8.0
    CVE-2024-44383

    WAYOS FBM-291W v19.09.11 is vulnerable to Command Execution via msp_info_htm.

  • High 7.2
    CVE-2024-44916

    Vulnerability in admin_ip.php in Seacms v13.1, when action=set, allows attackers to control IP parameters that are writ…

  • Medium 5.1
    CVE-2021-38120

    Remote Code Execution using Bash command Injection in backup scheduling functionality in NetIQ Advance Authentication

    A vulnerability identified in Advance Authentication that allows bash command Injection in administrative controlled functionality of backup due to improper handling in provided command parameters. This issue affects NetIQ Advance Authentication version befor…

    OpenText NetIQ Advance Authentication
  • Critical 9.8
    CVE-2024-42905 EPSS 15%

    Beijing Digital China Cloud Technology Co., Ltd. DCME-320 v.7.4.12.60 has a command execution vulnerability, which can …

  • Medium 6.3
    CVE-2024-8214

    D-Link DNS-1550-04 hd_config.cgi cgi_FMT_Std2R5_2nd_DiskMGR command injection

    A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-…

    D-Link DNS-320 DNS-340L DNS-327L Network devices
  • Medium 6.3
    CVE-2024-8213

    D-Link DNS-1550-04 hd_config.cgi cgi_FMT_R12R5_1st_DiskMGR command injection

    A vulnerability classified as critical has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8212

    D-Link DNS-1550-04 hd_config.cgi cgi_FMT_R12R5_2nd_DiskMGR command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It h…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8211

    D-Link DNS-1550-04 hd_config.cgi cgi_FMT_Std2R1_DiskMGR command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It h…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8210

    D-Link DNS-1550-04 hd_config.cgi sprintf command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It h…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8134

    D-Link DNS-1550-04 HTTP POST Request hd_config.cgi cgi_FMT_Std2R5_1st_DiskMGR command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It h…

    D-Link DNS-320 DNS-340L DNS-327L Network devices
  • Medium 6.3
    CVE-2024-8133

    D-Link DNS-1550-04 HTTP POST Request hd_config.cgi cgi_FMT_R5_SpareDsk_DiskMGR command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It h…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8132 EPSS 24%

    D-Link DNS-1550-04 HTTP POST Request webdav_mgr.cgi webdav_mgr command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It h…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8131

    D-Link DNS-1550-04 HTTP POST Request apkg_mgr.cgi module_enable_disable command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and c…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8130

    D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3 command injection

    A vulnerability has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 …

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8129 EPSS 24%

    D-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3_modify command injection

    A vulnerability, which was classified as critical, was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 a…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8128

    D-Link DNS-1550-04 HTTP POST Request webfile_mgr.cgi cgi_add_zip command injection

    A vulnerability, which was classified as critical, has been found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-8127

    D-Link DNS-1550-04 HTTP POST Request webfile_mgr.cgi cgi_unzip command injection

    A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • High 8.8
    CVE-2024-44382

    D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in the jhttpd upgrade_filter_asp function.

  • High 8.8
    CVE-2024-44381

    D-Link DI_8004W 16.07.26A1 contains a command execution vulnerability in jhttpd msp_info_htm function.

  • High 7.2
    CVE-2024-42636

    DedeCMS V5.7.115 has a command execution vulnerability via file_manage_view.php?fmdo=newfile&activepath.

  • Medium 6.4
    CVE-2024-7110

    Improper Neutralization of Special Elements used in a Command ('Command Injection') in GitLab

    An issue was discovered in GitLab EE affecting all versions starting 17.0 to 17.1.6, 17.2 prior to 17.2.4, and 17.3 prior to 17.3.1 allows an attacker to execute arbitrary command in a victim's pipeline through prompt injection.

    GitLab GitLab gitlab Web / CMS Ubuntu
  • High 8.0
    CVE-2024-43027

    DrayTek Vigor 3900 before v1.5.1.5_Beta, DrayTek Vigor 2960 before v1.5.1.5_Beta and DrayTek Vigor 300B before v1.5.1.5…

  • Medium 6.3
    CVE-2024-7922 EPSS 20%

    D-Link DNS-1550-04 myMusic.cgi cgi_write_playlist command injection

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814 and c…

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.3
    CVE-2024-7907

    TOTOLINK X6000R cstecgi.cgi setSyslogCfg command injection

    A vulnerability, which was classified as critical, has been found in TOTOLINK X6000R 9.4.0cu.852_20230719. This issue affects the function setSyslogCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument rtLogServer leads to command injection. …

    Toto Link X6000R
  • Medium 6.3
    CVE-2024-7897

    Tosei Online Store Management System ネット店舗管理システム tosei_kikai.php command injection

    A vulnerability classified as critical has been found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. This affects an unknown part of the file /cgi-bin/tosei_kikai.php. The manipulation of the argument kikaibangou leads to command injectio…

    Tosei Online Store Management System ネット店舗管理システム
  • Medium 6.3
    CVE-2024-7896

    Tosei Online Store Management System ネット店舗管理システム p1_ftpserver.php command injection

    A vulnerability was found in Tosei Online Store Management System ネット店舗管理システム 4.02/4.03/4.04. It has been rated as critical. Affected by this issue is some unknown functionality of the file /cgi-bin/p1_ftpserver.php. The manipulation of the argument adr_txt l…

    Tosei Online Store Management System ネット店舗管理システム
  • Medium 6.3
    CVE-2024-7833

    D-Link DI-8100 upgrade_filter.asp upgrade_filter_asp command injection

    A vulnerability was found in D-Link DI-8100 16.07. It has been classified as critical. This affects the function upgrade_filter_asp of the file upgrade_filter.asp. The manipulation of the argument path leads to command injection. It is possible to initiate th…

    D-Link DI-8100 Network devices
  • Critical 9.8
    CVE-2024-42947

    An issue in the handler function in /goform/telnet of Tenda FH1201 v1.2.0.14 (408) allows attackers to execute arbitrar…

  • Critical 9.8
    CVE-2024-42360

    Command Injection in sequenceserver

    SequenceServer lets you rapidly set up a BLAST+ server with an intuitive user interface for personal or group use. Several HTTP endpoints did not properly sanitize user input and/or query parameters. This could be exploited to inject and run unwanted shell co…

    wurmlab sequenceserver sequenceserver RubyGems
  • High 7.0
    CVE-2024-5914

    Cortex XSOAR: Command Injection in CommonScripts Pack

    A command injection issue in Palo Alto Networks Cortex XSOAR CommonScripts Pack allows an unauthenticated attacker to execute arbitrary commands within the context of an integration container.

    Palo Alto Networks Cortex XSOAR CommonScripts Network devices
  • Medium 6.3
    CVE-2024-7715 EPSS 26%

    D-Link DNS-1550-04 photocenter_mgr.cgi sprintf command injection

    ** UNSUPPORTED WHEN ASSIGNED ** A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and …

    D-Link DNS-320 DNS-340L DNS-325 Network devices
  • Medium 6.5
    CVE-2024-7700

    Foreman: command injection in "host init config" template via "install packages" field on foreman

    A command injection flaw was found in the "Host Init Config" template in the Foreman application via the "Install Packages" field on the "Register Host" page. This flaw allows an attacker with the necessary privileges to inject arbitrary commands into the con…

    Red Hat Red Hat Satellite 6
  • High 8.7
    CVE-2024-21879

    URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway v4.x to v8.x and < v8.2.4225

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability through an url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection.This issue affects Envoy: from 4…

    Enphase Envoy
  • High 8.6
    CVE-2024-21880

    URL parameter manipulations allows an authenticated attacker to execute arbitrary OS commands in Enphase IQ Gateway version 4.x <= 7.x

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability via the url parameter of an authenticated enpoint in Enphase IQ Gateway (formerly known as Enphase) allows OS Command Injection.This issue affects Envoy: 4.x <= …

    Enphase Envoy
  • Critical 9.2
    CVE-2024-21878

    Command Injection through Unsafe File Name Evaluation in internal script in Enphase IQ Gateway v4.x to and including 8.x

    Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Enphase IQ Gateway (formerly known as Envoy) allows OS Command Injection. This vulnerability is present in an internal script.This issue affects Envoy: from 4…

    Enphase Envoy
  • Low 3.0
    CVE-2024-22122

    AT(GSM) Command Injection

    Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute a…

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 5.5
    CVE-2024-7616

    Edimax IC-6220DC/IC-5150W ipcam_cgi cgiFormString command injection

    A vulnerability was found in Edimax IC-6220DC and IC-5150W up to 3.06. It has been rated as critical. Affected by this issue is the function cgiFormString of the file ipcam_cgi. The manipulation of the argument host leads to command injection. NOTE: The vendo…

    Edimax IC-5150W IC-6220DC
  • Critical 9.1
    CVE-2024-37023

    Vonets WiFi Bridges Command Injection

    Multiple OS command injection vulnerabilities affecting Vonets industrial wifi bridge relays and wifi bridge repeaters, software versions 3.3.23.6.9 and prior, enable an authenticated remote attacker to execute arbitrary OS commands via various endpoint param…

    Vonets VBG1200 VAP11S VAR1200-H
  • Critical 10.0
    CVE-2024-3659

    Command injection in KAON AR2140 routers

    Firmware in KAON AR2140 routers, prior to versions 3.2.50 and 4.2.16, is vulnerable to a shell command injection via sending a crafted request to one of the endpoints. In order to exploit this vulnerability, one has to have access to the administrative portal…

    Kaon AR2140