Improper Neutralization of Special Elements used in a Command
CWE-77
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
We track 2,127 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 41 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
Latest Improper Neutralization of Special Elements used in a Command vulnerabilities
- 9.8 Critical severity
Node.js: Improper Neutralization of Special Elements used in a Command
A command inject vulnerability allows an attacker to perform command injection on Windows applications that indirectly depend on the CreateProcess function when the specific conditions are satisfied.
- 8.8 High severity
Pods – Custom Content Types and Fields: Improper Neutralization of Special Elements used in a Command
The Pods – Custom Content Types and Fields plugin for WordPress is vulnerable to Remote Code Exxecution via shortcode in all versions up to, and including, 3.0.10 (with the exception of 2.7.31.2, 2.8.23.2, 2.9.19.2). This makes it possible for authenticated at
- 9.8 Critical severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Improper Neutralization of Special Elements used in a Command
A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially
- 9.8 Critical severity
AC1350 Wireless MU-MIMO Gigabit Access Point…: Improper Neutralization of Special Elements used in a Command
A command execution vulnerability exists in the tddpd enable_test_mode functionality of Tp-Link AC1350 Wireless MU-MIMO Gigabit Access Point (EAP225 V3) v5.1.0 Build 20220926 and Tp-Link N300 Wireless Access Point (EAP115 V4) v5.0.4 Build 20220216. A specially
- 8.0 High severity
ex200_firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK EX200 V4.0.3c.7646_B20201211 was discovered to contain a remote code execution (RCE) vulnerability via the langType parameter in the setLanguageCfg function.
- 8.8 High severity
ac18_firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in /goform/exeCommand in Tenda AC18 v15.03.05.05, which allows attackers to construct cmdinput parameters for arbitrary command execution.
- 9.8 Critical severity
UniFi Network Application: Improper Neutralization of Special Elements used in a Command
A Command Injection vulnerability found in a Self-Hosted UniFi Network Servers (Linux) with UniFi Network Application (Version 8.0.28 and earlier) allows a malicious actor with UniFi Network Application Administrator credentials to escalate privileges to root
- 9.8 Critical severity
pgAdmin 4: Improper Neutralization of Special Elements used in a Command
pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system'
- 9.8 Critical severity
D-Link Multiple NAS Devices Command Injection Exploited
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in D-Link DNS-320L, DNS-325, DNS-327L and DNS-340L up to 20240403. Affected is an unknown function of the file /cgi-bin/nas_sharing.cgi of the component HTTP GET Reque
- 7.4 High severity
VMware SD-WAN Edge: Improper Neutralization of Special Elements used in a Command
VMware SD-WAN Edge contains an unauthenticated command injection vulnerability potentially leading to remote code execution. A malicious actor with local access to the Edge Router UI during activation may be able to perform a command injection attack that coul
- 7.2 High severity
DS-7604NI-K1 / 4P(B): Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in some Hikvision NVRs. This could allow an authenticated user with administrative rights to execute arbitrary commands.
- 8.8 High severity
Sentry: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in Ivanti Sentry prior to 9.19.0 allows unauthenticated threat actor to execute arbitrary commands on the underlying operating system of the appliance within the same physical or logical network.
- 7.3 High severity
Red Hat Enterprise Linux 8: Improper Neutralization of Special Elements used in a Command
A flaw was found in Cockpit. Deleting a sosreport with a crafted name via the Cockpit web interface can lead to a command injection vulnerability, resulting in privilege escalation. This issue affects Cockpit versions 270 and newer.
- 8.8 High severity
Virtual Appliance (vApp) Manager: Improper Neutralization of Special Elements used in a Command
Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability leading to an execution of an inserted command. Dell recommends customers to upgrade at the earliest opp
- 8.8 High severity
Virtual Appliance (vApp) Manager: Improper Neutralization of Special Elements used in a Command
Dell vApp Manager, versions prior to 9.2.4.9 contain a Command Injection Vulnerability. An authorized attacker could potentially exploit this vulnerability leading to an execution of an inserted command. Dell recommends customers to upgrade at the earliest opp
- 8.8 High severity
FH1205: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Tenda FH1205 2.0.0.7(775) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The attack
- 8.8 High severity
FH1203: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Tenda FH1203 2.0.1.6 and classified as critical. This vulnerability affects the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The attack can be initi
- 8.1 High severity
Splunk Enterprise: Improper Neutralization of Special Elements used in a Command
In Splunk Enterprise versions below 9.2.1, 9.1.4, and 9.0.9, the Dashboard Examples Hub lacks protections for risky SPL commands. This could let attackers bypass SPL safeguards for risky commands in the Hub. The vulnerability would require the attacker to phis
- 8.8 High severity
FH1202: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Tenda FH1202 1.2.0.14(408) and classified as critical. Affected by this vulnerability is the function formWriteFacMac of the file /goform/WriteFacMac. The manipulation of the argument mac leads to command injection. The exploi
- 8.2 High severity
gradio-app/gradio: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the deploy+test-visual.yml workflow of the gradio-app/gradio repository, due to improper neutralization of special elements used in a command. This vulnerability allows attackers to execute unauthorized commands, pot
- 7.8 High severity
Linux: Improper Neutralization of Special Elements used in a Command
In the Linux kernel, the following vulnerability has been resolved: drm/amd/display: Wake DMCUB before executing GPINT commands [Why] DMCUB can be in idle when we attempt to interface with the HW through the GPINT mailbox resulting in a system hang. [How] Add
- 8.1 High severity
A-Tune-Collector: Improper Neutralization of Special Elements used in a Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in openEuler A-Tune-Collector on Linux allows Command Injection. This vulnerability is associated with program files https://gitee.Com/openeuler/A-Tune-Collector/
- 7.3 High severity
RG-NBS2009G-P: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Ruijie RG-NBS2009G-P up to 20240305. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /EXCU_SHELL. The manipulation of the argument Command1 leads to command injection. The at
- 8.4 High severity
astropy: Improper Neutralization of Special Elements used in a Command
Astropy is a project for astronomy in Python that fosters interoperability between Python astronomy packages. Version 5.3.2 of the Astropy core package is vulnerable to remote code execution due to improper input validation in the `TranformGraph().to_dot_graph
- 10.0 Critical severity
tew-827dru_firmware: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.@smb[%d].username in the apply.cgi interface, thereby gaining root shell privile
- 8.8 High severity
tew-827dru_firmware: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in the TRENDnet TEW-827DRU router with firmware version 2.10B01. An attacker can inject commands into the post request parameters usapps.config.smb_admin_name in the apply.cgi interface, thereby gaining root shell pri
- 8.8 High severity
vinchin_backup_and_recovery: Improper Neutralization of Special Elements used in a Command
Vinchin Backup and Recovery 7.2 and Earlier is vulnerable to Authenticated Remote Code Execution (RCE) via the getVerifydiyResult function in ManoeuvreHandler.class.php.
- 9.1 Critical severity
SAP NetWeaver AS Java (Administrator Log…: Improper Neutralization of Special Elements used in a Command
SAP NetWeaver Administrator AS Java (Administrator Log Viewer plug-in) - version 7.50, allows an attacker with high privileges to upload potentially dangerous files which leads to command injection vulnerability. This would enable the attacker to run commands
- 9.8 Critical severity
1Panel: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, has been found in 1Panel up to 1.10.1-lts. Affected by this issue is the function baseApi.UpdateDeviceSwap of the file /api/v1/toolbox/device/update/swap. The manipulation of the argument Path with the input 1
- 7.8 High severity
macOS: Improper Neutralization of Special Elements used in a Command
The issue was addressed with improved memory handling. This issue is fixed in macOS Monterey 12.7.4, macOS Sonoma 14.4, macOS Ventura 13.6.5. Processing a file may lead to unexpected app termination or arbitrary code execution.
- 7.2 High severity
ArubaOS Wi-Fi Controllers and Campus/Remote…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
ArubaOS Wi-Fi Controllers and Campus/Remote…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
ArubaOS Wi-Fi Controllers and Campus/Remote…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
ArubaOS Wi-Fi Controllers and Campus/Remote…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 8.8 High severity
Aruba ClearPass Policy Manager: Improper Neutralization of Special Elements used in a Command
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlyi
- 8.8 High severity
Aruba ClearPass Policy Manager: Improper Neutralization of Special Elements used in a Command
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlyi
- 8.8 High severity
Aruba ClearPass Policy Manager: Improper Neutralization of Special Elements used in a Command
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlyi
- 8.8 High severity
Aruba ClearPass Policy Manager: Improper Neutralization of Special Elements used in a Command
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlyi
- 8.8 High severity
Aruba ClearPass Policy Manager: Improper Neutralization of Special Elements used in a Command
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlyi
- 8.0 High severity
e1700_firmware: Improper Neutralization of Special Elements used in a Command
An issue was discovered in Linksys Router E1700 version 1.0.04 (build 3), allows authenticated attackers to execute arbitrary code via the setDateTime function.