Improper Neutralization of Special Elements used in a Command
CWE-77
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
We track 2,127 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 41 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
Latest Improper Neutralization of Special Elements used in a Command vulnerabilities
- 9.8 Critical severity
centrestack: Improper Neutralization of Special Elements used in a Command
An LDAP injection vulnerability in the login page of Gladinet CentreStack v13.12.9934.54690 allows attackers to access sensitive data or execute arbitrary commands via a crafted payload injected into the username field.
- 7.8 High severity
QuRouter: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow local network attackers to execute commands. We have already fixed the vulnerability in the following versions: QuRouter 2.4
- 9.8 Critical severity
QuRouter: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect several product versions. If exploited, the vulnerability could allow remote attackers to execute commands. We have already fixed the vulnerability in the following version: QuRouter 2.4.3.103 a
- 8.8 High severity
Notes Station 3: Improper Neutralization of Special Elements used in a Command
An OS command injection vulnerability has been reported to affect Notes Station 3. If exploited, the vulnerability could allow remote authenticated attackers to execute commands. We have already fixed the vulnerability in the following version: Notes Station 3
- 8.0 High severity
tl-ipc42c_firmware: Improper Neutralization of Special Elements used in a Command
TP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontend and backend.
- 9.8 Critical severity
Pandora FMS: Improper Neutralization of Special Elements used in a Command
Arbitrary commands execution on the server by exploiting a command injection vulnerability in the LDAP authentication mechanism. This issue affects Pandora FMS: from 700 through <=777.4
- 9.1 Critical severity
kw5515_firmware: Improper Neutralization of Special Elements used in a Command
An issue in Kasda LinkSmart Router KW5515 v1.7 and before allows an authenticated remote attacker to execute arbitrary OS commands via cgi parameters.
- 8.0 High severity
di-8400_firmware: Improper Neutralization of Special Elements used in a Command
D-LINK DI-8400 v16.07.26A1 was discovered to contain multiple remote command execution (RCE) vulnerabilities in the msp_info_htm function via the flag and cmd parameters.
- 9.1 Critical severity
kw6512_firmware: Improper Neutralization of Special Elements used in a Command
Multiple OS Command Injection vulnerabilities affecting Kasda LinkSmart Router KW6512 <= v1.3 enable an authenticated remote attacker to execute arbitrary OS commands via various cgi parameters.
- 8.8 High severity
Trend Micro Deep Security: Improper Neutralization of Special Elements used in a Command
A security agent manual scan command injection vulnerability in the Trend Micro Deep Security 20 Agent could allow an attacker to escalate privileges and execute arbitrary code on an affected machine. In certain circumstances, attackers that have legitimate ac
- 8.8 High severity
Apache HertzBeat: Improper Neutralization of Special Elements used in a Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache HertzBeat (incubating). This vulnerability can only be exploited by authorized attackers. This issue affects Apache HertzBeat (incubating): before 1.6.1
- 9.8 Critical severity
BeePhotos: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Task Manager component in Synology BeePhotos before 1.0.2-10026 and 1.1.0-10053 and Synology Photos before 1.6.2-0720 and 1.7.0-0795 allows remote attac
- 9.8 Critical severity
gogs/gogs: Improper Neutralization of Special Elements used in a Command
A remote command execution vulnerability exists in gogs/gogs versions <=0.12.7 when deployed on a Windows server. The vulnerability arises due to improper validation of the `tree_path` parameter during file uploads. An attacker can set `tree_path=.git.` to upl
- 9.6 Critical severity
cli: Improper Neutralization of Special Elements used in a Command
The GitHub CLI version 2.6.1 and earlier are vulnerable to remote code execution through a malicious codespace SSH server when using `gh codespace ssh` or `gh codespace logs` commands. This has been patched in the cli v2.62.0. Developers connect to remote code
- 9.8 Critical severity
dwr-2000m_firmware: Improper Neutralization of Special Elements used in a Command
An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to execute arbitrary code via a crafted request.
- 8.0 High severity
dwr-2000m_firmware: Improper Neutralization of Special Elements used in a Command
An issue in DLink DWR 2000M 5G CPE With Wifi 6 Ax1800 and Dlink DWR 5G CPE DWR-2000M_1.34ME allows a local attacker to execute arbitrary code via a crafted payload to the Diagnostics function.
- 7.2 High severity
RUGGEDCOM RM1224 LTE(4G) EU: Improper Neutralization of Special Elements used in a Command
A vulnerability has been identified in RUGGEDCOM RM1224 LTE(4G) EU (6GK6108-4AM00-2BA2) (All versions < V8.2), RUGGEDCOM RM1224 LTE(4G) NAM (6GK6108-4AM00-2DA2) (All versions < V8.2), SCALANCE M804PB (6GK5804-0AP00-2AA2) (All versions < V8.2), SCALANCE M812-1
- 7.8 High severity
SmartFabric OS10 Software: Improper Neutralization of Special Elements used in a Command
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) a command injection vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Command execution.
- 7.8 High severity
SmartFabric OS10 Software: Improper Neutralization of Special Elements used in a Command
Dell SmartFabric OS10 Software, version(s) 10.5.6.x, 10.5.5.x, 10.5.4.x, 10.5.3.x, contain(s) an Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability. A low privileged attacker with local access could potentially ex
- 9.8 Critical severity
sublime_text_4: Improper Neutralization of Special Elements used in a Command
Sublime Text 4 was discovered to contain a command injection vulnerability via the New Build System module. NOTE: multiple third parties report that this is intended behavior.
- 8.0 High severity
dir-820l_firmware: Improper Neutralization of Special Elements used in a Command
D-Link DIR-820L 1.05b03 was discovered to contain a remote code execution (RCE) vulnerability via the ping_addr parameter in the ping_v4 and ping_v6 functions.
- 9.8 Critical severity
DI-8003: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been classified as critical. Affected is the function upgrade_filter_asp of the file /upgrade_filter.asp. The manipulation of the argument path leads to os command injection. It is possible to laun
- 7.8 High severity
Elefant Software Updater: Improper Neutralization of Special Elements used in a Command
An attacker with local access the to medical office computer can escalate his Windows user privileges to "NT AUTHORITY\SYSTEM" by exploiting a command injection vulnerability in the Elefant Update Service. The command injection can be exploited by communicatin
- 8.8 High severity
X18: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected by this issue is some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injecti
- 9.8 Critical severity
symfony: Improper Neutralization of Special Elements used in a Command
Symphony process is a module for the Symphony PHP framework which executes commands in sub-processes. On Windows, when an executable file named `cmd.exe` is located in the current working directory it will be called by the `Process` class when preparing comman
- 10.0 Critical severity
Cisco Aironet Access Point Software (IOS XE…: Improper Neutralization of Special Elements used in a Command
A vulnerability in the web-based management interface of Cisco Unified Industrial Wireless Software for Cisco Ultra-Reliable Wireless Backhaul (URWB) Access Points could allow an unauthenticated, remote attacker to perform command injection attacks with root p
- 9.8 Critical severity
lensvisual: Improper Neutralization of Special Elements used in a Command
An issue in Lens Visual integration with Power BI v.4.0.0.3 allows a remote attacker to execute arbitrary code via the Natural language processing component
- 7.2 High severity
HPE Aruba Networking Access Points, Instant…: Improper Neutralization of Special Elements used in a Command
An authenticated command injection vulnerability exists in the Instant AOS-8 and AOS-10 command line interface. A successful exploitation of this vulnerability results in the ability to execute arbitrary commands as a privileged user on the underlying operatin
- 9.0 Critical severity
HPE Aruba Networking Access Points, Instant…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of t
- 9.8 Critical severity
HPE Aruba Networking Access Points, Instant…: Improper Neutralization of Special Elements used in a Command
Command injection vulnerability in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of t
- 7.5 High severity
Certain Poly Video Conference Devices: Improper Neutralization of Special Elements used in a Command
A potential vulnerability was discovered in certain Poly video conferencing devices. The firmware flaw does not properly sanitize user input. The exploitation of this vulnerability is dependent on a layered attack and cannot be exploited by itself.
- 8.0 High severity
r7000p_firmware: Improper Neutralization of Special Elements used in a Command
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component wlg_adv.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbi
- 9.8 Critical severity
CoslatV3: Improper Neutralization of Special Elements used in a Command
Improper Control of Generation of Code ('Code Injection'), Improper Neutralization of Special Elements used in a Command ('Command Injection'), Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in BG-TEK I
- 9.8 Critical severity
AC6: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Tenda AC6 15.03.05.19 and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac of the component API Endpoint. The manipulation of the argument mac leads to comm
- 9.8 Critical severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the acme_process function.
- 9.8 Critical severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the ruequest_certificate function.
- 9.8 Critical severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the setup_cacertificate function.
- 8.8 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the sign_cacertificate function.
- 8.4 High severity
kerui_hd_3mp_1080p_tuya_camera_firmware: Improper Neutralization of Special Elements used in a Command
KERUI HD 3MP 1080P Tuya Camera 1.0.4 has a command injection vulnerability in the module that connects to the local network via a QR code. This vulnerability allows an attacker to create a custom, unauthenticated QR code and abuse one of the parameters, either
- 8.8 High severity
vigor3900_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor3900 1.5.1.3 allows attackers to inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doSSLTunnel function.