Improper Neutralization of Special Elements used in a Command
CWE-77
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
We track 2,127 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 41 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
Latest Improper Neutralization of Special Elements used in a Command vulnerabilities
- 9.8 Critical severity
profinet_inspektor_nt: Improper Neutralization of Special Elements used in a Command
In Indo-Sol PROFINET-INspektor NT through 2.4.0, a command injection vulnerability in the gedtupdater service of the firmware allows remote attackers to execute arbitrary system commands with root privileges via a crafted filename parameter in POST requests to
- 9.8 Critical severity
X6000R AX3000: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Totolink X6000R AX3000 9.4.0cu.852_20230719. It has been rated as critical. This issue affects the function setWizardCfg of the file /cgi-bin/cstecgi.cgi of the component shttpd. The manipulation leads to command injection. The exp
- 9.8 Critical severity
dir-816_a2_firmware: Improper Neutralization of Special Elements used in a Command
Command Injection vulnerability in D-Link Dir 816 with firmware version DIR-816_A2_v1.10CNB04 allows attackers to run arbitrary commands via the urlAdd parameter.
- 8.8 High severity
dir_882_firmware: Improper Neutralization of Special Elements used in a Command
Command Injection vulnerability in D-Link Dir 882 with firmware version DIR882A1_FW130B06 allows attackers to run arbitrary commands via crafted POST request to /HNAP1/.
- 7.8 High severity
pymatgen: Improper Neutralization of Special Elements used in a Command
Pymatgen (Python Materials Genomics) is an open-source Python library for materials analysis. A critical security vulnerability exists in the `JonesFaithfulTransformation.from_transformation_str()` method within the `pymatgen` library prior to version 2024.2.2
- 8.8 High severity
eap-767: Improper Neutralization of Special Elements used in a Command
Command Injection vulnerability discovered in 4ipnet EAP-767 device v3.42.00 within the web interface of the device allows attackers with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges.
- 8.7 High severity
BIG-IP: Improper Neutralization of Special Elements used in a Command
When running in appliance mode, an authenticated remote command injection vulnerability exists in an undisclosed iControl REST endpoint on multi-bladed systems. A successful exploit can allow the attacker to cross a security boundary. Note: Software versions w
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring SMTP options. Exploitation of thi
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via nomad templates when configuring audit log forwarding. Exploitatio
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when configuring SAML settings. Exploitation of this vulnerability req
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting the username and password for collectd configurations. Ex
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance when setting up an HTTP proxy. Exploitation of this vulnerability requ
- 9.1 Critical severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the actions-console docker container while setting a service URL.
- 8.0 High severity
Enterprise Server: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin SSH access to the appliance via the `syslog-ng` configuration file. Exploitation of this vulnerabi
- 8.3 High severity
QTS: Improper Neutralization of Special Elements used in a Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QT
- 7.8 High severity
Kitty: Improper Neutralization of Special Elements used in a Command
KiTTY versions 0.76.1.13 and before is vulnerable to command injection via the filename variable, occurs due to insufficient input sanitization and validation, failure to escape special characters, and insecure system calls (at lines 2369-2390). This allows an
- 9.8 Critical severity
Rosemount GC370XA: Improper Neutralization of Special Elements used in a Command
In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an authenticated user with network access could run arbitrary commands from a remote computer.
- 9.8 Critical severity
Rosemount GC370XA: Improper Neutralization of Special Elements used in a Command
In Emerson Rosemount GC370XA, GC700XA, and GC1500XA products, an unauthenticated user with network access could execute arbitrary commands in root context from a remote computer.
- 9.8 Critical severity
Dir-816 Firmware: Improper Neutralization of Special Elements used in a Command
An issue in Dlink DIR-816A2 v.1.10CNB05 allows a remote attacker to execute arbitrary code via the wizardstep4_ssid_2 parameter in the sub_42DA54 function.
- 9.8 Critical severity
Zentao: Improper Neutralization of Special Elements used in a Command
Zentao v18.0 to v18.10 was discovered to contain a remote code execution (RCE) vulnerability via the checkConnection method of /app/zentao/module/repo/model.php.
- 7.2 High severity
Gtb Central Console: Improper Neutralization of Special Elements used in a Command
An issue was discovered in GTB Central Console 15.17.1-30814.NG. The method systemSettingsDnsDataAction at /opt/webapp/src/AppBundle/Controller/React/SystemSettingsController.php is vulnerable to command injection via the /old/react/v1/api/system/dns/data endp
- 8.8 High severity
Photo Station: Improper Neutralization of Special Elements used in a Command
An OS command injection vulnerability has been reported to affect Photo Station. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following version: Photo Station
- 9.8 Critical severity
QTS: Improper Neutralization of Special Elements used in a Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following versions: QT
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in a Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the
- 7.2 High severity
QTS: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed the vulnerability in the
- 8.8 High severity
Vinchin Backup And Recovery: Improper Neutralization of Special Elements used in a Command
Vinchin Backup & Recovery v7.2 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the setNetworkCardInfo function.
- 9.8 Critical severity
Web Clipper: Improper Neutralization of Special Elements used in a Command
In Notion Web Clipper 1.0.3(7), a .nib file is susceptible to the Dirty NIB attack. NIB files can be manipulated to execute arbitrary commands. Additionally, even if a NIB file is modified within an application, Gatekeeper may still permit the execution of the
- 9.8 Critical severity
network: Improper Neutralization of Special Elements used in a Command
Versions of the package network before 0.7.0 are vulnerable to Arbitrary Command Injection due to use of the child_process exec function without input sanitization. If (attacker-controlled) user input is given to the mac_address_for function of the package, it
- 7.2 High severity
TEW-822DRE: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in TRENDnet TEW-822DRE 1.03B02. It has been declared as critical. This vulnerability affects unknown code of the file /admin_ping.htm of the component POST Request Handler. The manipulation of the argument ipv4_ping/ipv6_ping leads to
- 7.2 High severity
TEW-815DAP: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in TRENDnet TEW-815DAP 1.0.2.0. It has been classified as critical. This affects the function do_setNTP of the component POST Request Handler. The manipulation of the argument NtpDstStart/NtpDstEnd leads to command injection. It is po
- 7.8 High severity
Tew-824dru Firmware: Improper Neutralization of Special Elements used in a Command
An issue was discovered in TRENDnet TEW-824DRU version 1.04b01, allows unauthenticated attackers to execute arbitrary code via the system.ntp.server parameter in the sub_420AE0() function. The attack can be launched remotely.
- 8.8 High severity
MR2600: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the 'SaveStaticRouteIPv6Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed.
- 8.8 High severity
MR2600: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the 'SaveStaticRouteIPv4Params' parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed.
- 8.8 High severity
MR2600: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the ‘SaveSysLogParams’ parameter of the Motorola MR2600. A remote attacker can exploit this vulnerability to achieve command execution. Authentication is required, however can be bypassed.
- 9.8 Critical severity
DAP-1650: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in D-Link DAP-1650 devices when handling UPnP SUBSCRIBE messages. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.
- 9.8 Critical severity
DAP-1650: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in the gena.cgi module of D-Link DAP-1650 devices. An unauthenticated attacker can exploit this vulnerability to gain command execution on the device as root.
- 8.1 High severity
Tew-411brpplus Firmware: Improper Neutralization of Special Elements used in a Command
A command injection issue in TRENDnet TEW-411BRPplus v.2.07_eu that allows a local attacker to execute arbitrary code via the data1 parameter in the debug.cgi page.
- 9.8 Critical severity
NVR 504: Improper Neutralization of Special Elements used in a Command
SystemK NVR 504/508/516 versions 2.3.5SK.30084998 and prior are vulnerable to a command injection vulnerability in the dynamic domain name system (DDNS) settings that could allow an attacker to execute arbitrary commands with root privileges.
- 9.8 Critical severity
Mathtex: Improper Neutralization of Special Elements used in a Command
Command Injection vulnerability in Mathtex v.1.05 and before allows a remote attacker to execute arbitrary code via crafted string in application URL.