Improper Neutralization of Special Elements used in a Command
CWE-77
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
We track 2,127 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 41 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
Latest Improper Neutralization of Special Elements used in a Command vulnerabilities
- 8.8 High severity
MXsecurity Series: Improper Neutralization of Special Elements used in a Command
MXsecurity version 1.0 is vulnearble to command injection vulnerability. This vulnerability has been reported in the SSH CLI program, which can be exploited by attackers who have gained authorization privileges. The attackers can break out of the restricted sh
- 7.8 High severity
Luatex: Improper Neutralization of Special Elements used in a Command
LuaTeX before 1.17.0 allows execution of arbitrary shell commands when compiling a TeX file obtained from an untrusted source. This occurs because luatex-core.lua lets the original io.popen be accessed. This also affects TeX Live before 2023 r66984 and MiKTeX
- 7.8 High severity
emacs: Improper Neutralization of Special Elements used in a Command
A flaw was found in the Emacs text editor. Processing a specially crafted org-mode code with the "org-babel-execute:latex" function in ob-latex.el can result in arbitrary command execution. This CVE exists because of a CVE-2023-28617 security regression for th
- 8.8 High severity
Checkmk: Improper Neutralization of Special Elements used in a Command
Improper neutralization of livestatus command delimiters in the RestAPI in Checkmk < 2.0.0p36, < 2.1.0p28, and < 2.2.0b8 (beta) allows arbitrary livestatus command execution for authorized users.
- 9.8 Critical severity
Cp300+ Firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the hostTime parameter in the function NTPSyncWithHostof TOTOLINK CP300+ V5.2cu.7594_B20200910 allows attackers to execute arbitrary commands via a crafted http packet.
- 9.8 Critical severity
Br-6428ns Firmware: Improper Neutralization of Special Elements used in a Command
A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the setWAN function in /bin/webs without any limitations.
- 9.8 Critical severity
Br-6428ns Firmware: Improper Neutralization of Special Elements used in a Command
A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the mp function in /bin/webs without any limitations.
- 8.8 High severity
AVideo: Improper Neutralization of Special Elements used in a Command
WWBN AVideo is an open source video platform. In versions 12.4 and prior, a command injection vulnerability exists at `plugin/CloneSite/cloneClient.json.php` which allows Remote Code Execution if you CloneSite Plugin. This is a bypass to the fix for CVE-2023-3
- 9.8 Critical severity
Live: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Caton Live up to 2023-04-26 and classified as critical. This issue affects some unknown processing of the file /cgi-bin/ping.cgi of the component Mini_HTTPD. The manipulation of the argument address with the input ;id;uname${IFS}-a
- 9.8 Critical severity
Br-6428ns Firmware: Improper Neutralization of Special Elements used in a Command
A Command Injection vulnerability in Edimax Wireless Router N300 Firmware BR-6428NS_v4 allows attacker to execute arbitrary code via the formAccept function in /bin/webs without any limitations.
- 9.8 Critical severity
html/template: Improper Neutralization of Special Elements used in a Command
Not all valid JavaScript whitespace characters are considered to be whitespace. Templates containing whitespace characters outside of the character set "\t\n\f\r\u0020\u2028\u2029" in JavaScript contexts that also contain actions may not be properly sanitized
- 8.8 High severity
AC23: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Tenda AC23 16.03.07.45_cn. It has been declared as critical. This vulnerability affects unknown code of the file /bin/ate of the component Service Port 7329. The manipulation of the argument v2 leads to command injection. The attac
- 8.8 High severity
E-Office: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Weaver E-Office 9.5 and classified as critical. Affected by this issue is some unknown functionality of the file /webroot/inc/utility_all.php of the component File Upload Handler. The manipulation leads to command injection. The at
- 9.8 Critical severity
My Cloud OS 5: Improper Neutralization of Special Elements used in a Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability that could allow an attacker to execute code in the context of the root user on a vulnerable CGI file was discovered in Western Digital My Cloud OS 5 devicesThis
- 7.5 High severity
Gl-mv1000w Firmware: Improper Neutralization of Special Elements used in a Command
An issue was discovered on GL.iNet devices running firmware before 3.216. There is an arbitrary file write in which an empty file can be created almost anywhere on the filesystem, as long as the filename and path is no more than 6 characters (the working direc
- 7.2 High severity
SIMATIC Cloud Connect 7 CC712: Improper Neutralization of Special Elements used in a Command
A vulnerability has been identified in SIMATIC Cloud Connect 7 CC712 (All versions >= V2.0 < V2.1), SIMATIC Cloud Connect 7 CC716 (All versions >= V2.0 < V2.1). The web based management of affected devices does not properly validate user input, making it susce
- 9.9 Critical severity
SCALANCE LPE9403: Improper Neutralization of Special Elements used in an OS Command
A vulnerability has been identified in SCALANCE LPE9403 (All versions < V2.1). The web based management of affected device does not properly validate user input, making it susceptible to command injection. This could allow an authenticated remote attacker to a
- 8.8 High severity
Aruba Access Points running InstantOS and…: Improper Neutralization of Special Elements used in a Command
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underl
- 8.8 High severity
Aruba Access Points running InstantOS and…: Improper Neutralization of Special Elements used in a Command
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underl
- 8.8 High severity
Aruba Access Points running InstantOS and…: Improper Neutralization of Special Elements used in a Command
Multiple authenticated command injection vulnerabilities exist in the Aruba InstantOS and ArubaOS 10 command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underl
- 8.8 High severity
EKI-1524: Improper Neutralization of Special Elements used in a Command
Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the device name input field, which can be triggered by authenticated users via a crafted POST request.
- 8.8 High severity
EKI-1524: Improper Neutralization of Special Elements used in a Command
Advantech EKI-1524, EKI-1522, EKI-1521 devices through 1.21 are affected by an command injection vulnerability in the NTP server input field, which can be triggered by authenticated users via a crafted POST request.
- 9.8 Critical severity
Ac18 Firmware: Improper Neutralization of Special Elements used in a Command
Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function.
- 9.8 Critical severity
Prime: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in Caton Prime 2.1.2.51.e8d7225049(202303031001) and classified as critical. This issue affects some unknown processing of the file cgi-bin/tools_ping.cgi?action=Command of the component Ping Handler. The manipulation of the argument
- 7.3 High severity
Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input…
Versions of the package github.com/gin-gonic/gin before 1.9.0 are vulnerable to Improper Input Validation by allowing an attacker to use a specially crafted request via the X-Forwarded-Prefix header, potentially leading to cache poisoning. **Note:** Although t
- 8.8 High severity
Apache Spark: Improper Neutralization of Special Elements used in a Command
** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACL
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A flaw has been found in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This affects an unknown function of the component Web Management Interface. This manipulation of the argument suffix-rate-up causes command injection. The attack may be initiated remotely. Th
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The impacted element is an unknown function of the component Web Management Interface. The manipulation of the argument Name results in command injection. The attack can be launched re
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security vulnerability has been detected in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. The affected element is an unknown function of the component Web Management Interface. The manipulation of the argument dpi leads to command injection. The attack can be
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A weakness has been identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. Impacted is an unknown function of the component Web Management Interface. Executing a manipulation of the argument src can lead to command injection. It is possible to launch the at
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A security flaw has been discovered in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This issue affects some unknown processing of the component Web Management Interface. Performing a manipulation of the argument ecn-down results in command injection. It is poss
- 8.8 High severity
EdgeRouter X: Improper Neutralization of Special Elements in Output Used by a Downstream Component
A vulnerability was identified in Ubiquiti EdgeRouter X up to 2.0.9-hotfix.6. This vulnerability affects unknown code of the component Web Management Interface. Such manipulation of the argument ecn-up leads to command injection. The attack may be performed fr
- 7.2 High severity
Cloud Pak for Data: Unrestricted Upload of File with Dangerous Type
IBM Cloud Pak for Data 4.5 and 4.6 could allow a privileged user to upload malicious files of dangerous types that can be automatically processed within the product's environment. IBM X-Force ID: 232034.
- 8.8 High severity
wip: Improper Neutralization of Special Elements used in a Command
`embano1/wip` is a GitHub Action written in Bash. Prior to version 2, the `embano1/wip` action uses the `github.event.pull_request.title` parameter in an insecure way. The title parameter is used in a run statement - resulting in a command injection vulnerabil
- 9.8 Critical severity
Dawnsparks-node-tesseract: Improper Neutralization of Special Elements used in a Command
huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.
- 8.1 High severity
USG FLEX series firmware: Improper Neutralization of Special Elements used in a Command
A post-authentication command injection vulnerability in the “account_operator.cgi” CGI program of Zyxel USG FLEX series firmware versions 4.50 through 5.35, and VPN series firmware versions 4.30 through 5.35, which could allow a remote authenticated attacker
- 7.2 High severity
VMware Aria Operations for Logs (formerly…: Improper Neutralization of Special Elements used in a Command
VMware Aria Operations for Logs contains a command injection vulnerability. A malicious actor with administrative privileges in VMware Aria Operations for Logs can execute arbitrary commands as root.
- 8.8 High severity
snowflake-jdbc: Improper Neutralization of Special Elements used in a Command
Snowflake JDBC provides a JDBC type 4 driver that supports core functionality, allowing Java program to connect to Snowflake. Users of the Snowflake JDBC driver were vulnerable to a command injection vulnerability. An attacker could set up a malicious, publicl
- 9.8 Critical severity
X18 Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.
- 9.8 Critical severity
X18 Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg function.