Improper Neutralization of Special Elements used in a Command
CWE-77
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
We track 2,127 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 41 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
Latest Improper Neutralization of Special Elements used in a Command vulnerabilities
- 8.8 High severity
MoviePilot: Improper Neutralization of Special Elements used in a Command
MoviePilot through 3.1.5 contains a command injection vulnerability that allows attackers to execute arbitrary OS commands by embedding malicious instructions in untrusted content processed through tools like browse_webpage, search_web, and torrent metadata pa
- 10.0 Critical severity
DIR-868L: Improper Neutralization of Special Elements used in a Command
A vulnerability was determined in D-Link DIR-868L 2.01b05. This impacts the function system of the file /htdocs/cgibin of the component HNAP CGI Handler. Executing a manipulation of the argument SOAPACTION can lead to os command injection. The attack may be la
- 8.8 High severity
Microsoft 365 Apps for Enterprise: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Microsoft Office OneNote allows an unauthorized attacker to execute code over a network.
- 8.8 High severity
Microsoft Windows Command Injection Exploited
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
- 7.8 High severity
Windows 11 version 23H2: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.
- 8.8 High severity
Visual Studio Code: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- 10.0 Critical severity
WL-WN592AX6: Improper Neutralization of Special Elements used in a Command
A flaw has been found in Wavlink WL-WN592AX6 250422. This issue affects the function system of the component wmapd Daemon. Executing a manipulation can lead to os command injection. It is possible to launch the attack remotely. The exploit has been published a
- 9.9 Critical severity
WL-WN530BE1-A: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been detected in Wavlink WL-WN530BE1-A 251117. This affects the function popen of the file /cgi-bin/uploadVpn.cgi. Such manipulation of the argument Type leads to os command injection. The attack may be performed from remote. The e
- 10.0 Critical severity
BR-6208AC: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Edimax BR-6208AC 1.32. Impacted is an unknown function of the file /goform/formWlanMP. The manipulation of the argument readE2P leads to command injection. It is possible to initiate the attack remotely. The exploit is publicl
- 10.0 Critical severity
BR-6208AC: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Edimax BR-6208AC 1.32. This issue affects some unknown processing of the file /goform/formAutoFWupgrade. Executing a manipulation of the argument tftpsIP can lead to command injection. The attack may be performed from remote.
- 8.3 High severity
BR-6208AC: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Edimax BR-6208AC 1.32. This vulnerability affects unknown code of the file /goform/formAccept. Performing a manipulation of the argument submit-url results in command injection. The attack is possible to be carried out remotely. Th
- 9.9 Critical severity
E1700: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Linksys E1700 1.0.0.4.003. This affects the function setLinksysIpv6 of the file /goform/setLinksysIpv6. The manipulation of the argument _6rd_prefix/_6rd_prefix_len results in os command injection. The attack can be launched remote
- 9.9 Critical severity
E1700: Improper Neutralization of Special Elements used in a Command
A weakness has been identified in Linksys E1700 1.0.0.4.003. The affected element is the function setDMZ of the file /goform/setDMZ. Executing a manipulation of the argument MAC_addr can lead to os command injection. The attack can be executed remotely. The ex
- 9.9 Critical severity
E1700: Improper Neutralization of Special Elements used in a Command
A security flaw has been discovered in Linksys E1700 1.0.0.4.003. Impacted is the function addStaticRoute of the file /goform/addStaticRoute of the component Static Route Handler. Performing a manipulation of the argument staticRoute_IP_setting/staticRoute_Net
- 10.0 Critical severity
TEW-751DR: Improper Neutralization of Special Elements used in a Command
A vulnerability was detected in TRENDnet TEW-751DR, TEW-752DRU and TEW733GR 1.03B01/1.03B03. Affected is the function fwrite of the file pigwidgeon.cgi of the component Web Management Backend. The manipulation of the argument service results in os command inje
- 10.0 Critical severity
X300: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in TOZED X300 up to 6.01.3. This vulnerability affects the function process_ping of the component IPPingDiagnostics Handler. The manipulation of the argument Host results in os command injection. The attack can be launched remotely. T
- 9.9 Critical severity
Spug: Improper Neutralization of Special Elements used in a Command
A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit ha
- 9.1 Critical severity
h-ui: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the h-ui (version v0.0.25 and below) administrative API due to improper validation of the listen configuration field. When an authenticated administrator submits a value containing shell metacharacters, the applicati
- 8.8 High severity
ClearPass Policy Manager (CPPM): Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the API of ClearPass Policy Manager. Successful exploitation could allow an authenticated remote attacker to escalate privileges and gain administrative control of the affected system.
- 8.8 High severity
ClearPass Policy Manager (CPPM): Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the client software of ClearPass Policy Manager. Successful exploitation could allow an attacker who is able to supply crafted input to the affected software to execute arbitrary commands with elevated privileges on
- 9.8 Critical severity
ClearPass Policy Manager (CPPM): Improper Neutralization of Special Elements used in a Command
A vulnerability in an affected interface of ClearPass Policy Manager could allow an unauthenticated remote attacker to conduct SQL injection attacks against the ClearPass Policy Manager instance. Successful exploitation could allow an attacker to run arbitrary
- 10.0 Critical severity
X6000R: Improper Neutralization of Special Elements used in a Command
A security vulnerability has been detected in TOTOLINK X6000R 9.4.0cu.652_B20230116. The impacted element is the function firmware_check of the file /cgi-bin/cstecgi.cgi of the component UploadFirmwareFile Handler. Such manipulation of the argument file_name l
- 10.0 Critical severity
Ahsay AhsayCBS Command Injection Exploited
A flaw has been found in Ahsay AhsayCBS up to 9.15.2.69/10.3.4.44. This vulnerability affects unknown code of the file /rps/api/json/UpdateReceivers.do of the component Replication Receiver. Executing a manipulation of the argument random can lead to os comman
- 9.9 Critical severity
pi-llm-wiki: Improper Neutralization of Special Elements used in a Command
A flaw has been found in zosmaai pi-llm-wiki up to 0.11.7. Affected is an unknown function of the file mcp/index.ts of the component wiki_capture_source MCP tool. Executing a manipulation of the argument url can lead to os command injection. The attack can be
- 7.3 High severity
AnyTool: Improper Neutralization of Special Elements used in a Command
A vulnerability was identified in HKUDS AnyTool 0.1.0. Affected is the function subprocess.run of the file anytool/local_server/main.py of the component Execute Endpoint. The manipulation of the argument command/shell leads to os command injection. It is possi
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRnetwork/ping. Such manipulation of the argument url leads to command injection. It is possible to launch the attack remotely. The exploi
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function set_time_zone of the file /api/ZRFirmware/set_time_zone. This manipulation of the argument hostname/zonename causes command injection. It is possible to initiate the a
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. This affects the function set_syslog of the file /api/ZRnetwork/set_syslog. The manipulation of the argument conloglevel/log_size results in command injection. The attack may be performed from remote.
- 7.2 High severity
Instant ON: Improper Neutralization of Special Elements used in a Command
Command injection vulnerabilities exist in the affected interface of HPE Networking Instant ON that could allow an authenticated remote attacker with high privileges to perform command injection. Successful exploitation could allow an attacker to execute arbit
- 9.6 Critical severity
Instant ON: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in CLI of the affected HPE Networking Instant ON APs that could allow an unauthenticated adjacent attacker to perform command injection by sending specially crafted packets. Successful exploitation could allow an attack
- 9.8 Critical severity
git-js: Improper Neutralization of Special Elements used in a Command
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin compares parsed option names with literal dangerous option spe
- 8.1 High severity
git-js: Improper Neutralization of Special Elements used in a Command
simple-git, an interface for running git commands in any node.js application, enables applications to execute Git operations from JavaScript. Prior to 4.0.0, the default blockUnsafeOperationsPlugin does not completely reject configuration includes supplied thr
- 7.4 High severity
SurfSense: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in MODSetter SurfSense up to 2.0.3. This issue affects some unknown processing of the file /api/search-source/connectors/mcp/test of the component MCP Connector Integration. Such manipulation leads to command injection. It is pos
- 10.0 Critical severity
NAP930: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Netcore NAP930 0.1.241010.141410. This affects the function eval of the file /www/cgi-bin/network_tools of the component Network Tools CGI. The manipulation of the argument sid results in os command injection. The attack may be per
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was determined in Ziroom ZHOME A0101 1.0.1.0. Impacted is an unknown function of the file /api/ZRnetwork/set_passwd. This manipulation of the argument password1 causes command injection. The attack can be initiated remotely. The exploit has bee
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was found in Ziroom ZHOME A0101 1.0.1.0. This issue affects some unknown processing of the file /api/ZRQos/set_online_client. The manipulation of the argument mac results in command injection. It is possible to launch the attack remotely. The e
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability has been found in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects unknown code of the file /api/ZRQos/set_online_client. The manipulation of the argument ip leads to command injection. It is possible to initiate the attack remotely. The
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Ziroom ZHOME A0101 1.0.1.0. This affects an unknown part of the file /api/ZRnetwork/firstSetup_wifi. Executing a manipulation of the argument login_pwd can lead to command injection. The attack may be performed from remote. The exploit
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Ziroom ZHOME A0101 1.0.1.0. Affected by this issue is some unknown functionality of the file /api/ZRnetwork/firstLogin. Performing a manipulation of the argument firstLogin results in command injection. The attack is possible to
- 9.1 Critical severity
ZHOME A0101: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Ziroom ZHOME A0101 1.0.1.0. This vulnerability affects the function pop_usb_device of the file usr/lib/lua/luci/controller/api/zrUsb.lua of the component USB Device Management API. This manipulation of the argument path causes