Improper Neutralization of Special Elements used in a Command
CWE-77
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
We track 2,127 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 41 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
Latest Improper Neutralization of Special Elements used in a Command vulnerabilities
- 7.8 High severity
vigor2960_firmware: Improper Neutralization of Special Elements used in a Command
DrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system commands via the mainfunction.cgi 'parameter' parameter. NOTE: This vulnerability only affects products that are no longe
- 8.8 High severity
github-slug-action: Improper Neutralization of Special Elements used in a Command
github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0` and prior to version 4.4.1, this action uses the `github.head_ref` parameter in an insecure way. This vulnera
- 8.8 High severity
E11: Improper Neutralization of Special Elements used in a Command
The Akuvox E11 web server backend library allows command injection in the device phone-book contacts functionality. This could allow an attacker to upload files with executable command instructions.
- 7.8 High severity
Docker Desktop: Improper Neutralization of Special Elements used in a Command
Docker Desktop before 4.17.0 allows an attacker to execute an arbitrary command inside a Dev Environments container during initialization by tricking a user to open a crafted malicious docker-desktop:// URL.
- 7.8 High severity
kylin-system-updater: Improper Neutralization of Special Elements used in an OS Command
A vulnerability, which was classified as critical, was found in kylin-system-updater up to 1.4.20kord on Ubuntu Kylin. Affected is the function InstallSnap of the component Update Handler. The manipulation leads to command injection. The attack needs to be app
- 8.8 High severity
Advanced Server Access: Improper Neutralization of Special Elements used in a Command
Okta Advanced Server Access Client versions 1.13.1 through 1.65.0 are vulnerable to command injection due to the third party library webbrowser. An outdated library, webbrowser, used by the ASA client was found to be vulnerable to command injection. To exploit
- 8.8 High severity
Vigor 2960: Improper Neutralization of Special Elements used in a Command
** UNSUPPORTED WHEN ASSIGNED ** A vulnerability, which was classified as critical, was found in DrayTek Vigor 2960 1.5.1.4/1.5.1.5. Affected is an unknown function of the file mainfunction.cgi of the component Web Management Interface. The manipulation of the
- 9.8 Critical severity
EG7035-M11: Improper Neutralization of Special Elements used in a Command
Baicells EG7035-M11 devices with firmware through BCE-ODU-1.0.8 are vulnerable to improper code exploitation via HTTP GET command injections. Commands are executed using pre-login execution and executed with root permissions. The following methods have been te
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated command injection vulnerabilities exist in the ArubaOS command line interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating system.
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating sy
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating sy
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating sy
- 7.2 High severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
Authenticated remote command injection vulnerabilities exist in the ArubaOS web-based management interface. Successful exploitation of these vulnerabilities result in the ability to execute arbitrary commands as a privileged user on the underlying operating sy
- 9.8 Critical severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation o
- 9.8 Critical severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation o
- 9.8 Critical severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation o
- 9.8 Critical severity
Aruba Mobility Conductor (formerly Mobility…: Improper Neutralization of Special Elements used in a Command
There are multiple command injection vulnerabilities that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks access point management protocol) UDP port (8211). Successful exploitation o
- 9.8 Critical severity
BiSheng-WNM: Improper Neutralization of Special Elements used in a Command
There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could allow attackers to gain higher privileges.
- 9.8 Critical severity
BiSheng-WNM: Improper Neutralization of Special Elements used in a Command
There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution.
- 9.8 Critical severity
It7-lcs Firmware: Improper Neutralization of Special Elements used in a Command
Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda CP3 v.10<=V20220906024_2025 and Tenda IT7-PCS Tenda IT7-PCS<=V2209020914 and Tenda IT7-LCS Tenda IT7-LCS<=V2209020914 an
- 9.8 Critical severity
Asmb8-ikvm Firmware: Improper Neutralization of Special Elements used in a Command
ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.
- 8.8 High severity
Jetwave 2212g Firmware: Improper Neutralization of Special Elements used in a Command
Korenix Jetwave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection via /goform/formSysCmd. An attacker an modify the sysCmd parameter in order to execute commands as root.
- 8.8 High severity
Jetwave 2212g Firmware: Improper Neutralization of Special Elements used in a Command
Korenix JetWave 4200 Series 1.3.0 and JetWave 3000 Series 1.6.0 are vulnerable to Command Injection. An attacker can modify the file_name parameter to execute commands as root.
- 8.8 High severity
Rocket.chat: Improperly Controlled Modification of Object Prototype Attributes
A prototype pollution vulnerability exists in Rocket.Chat server <5.2.0 that could allow an attacker to a RCE under the admin account. Any user can create their own server in your cloud and become an admin so this vulnerability could affect the cloud infrastru
- 8.8 High severity
Wmb250ac Firmware: Improper Neutralization of Special Elements used in a Command
Aztech WMB250AC Mesh Routers Firmware Version 016 2020 devices improperly manage sessions, which allows remote attackers to bypass authentication in opportunistic circumstances and execute arbitrary commands with administrator privileges by leveraging an exist
- 7.3 High severity
Emacs: Improper Neutralization of Special Elements used in a Command
An issue was discovered in GNU Emacs through 28.2. In ruby-mode.el, the ruby-find-library-file function has a local command injection vulnerability. The ruby-find-library-file function is an interactive function, and bound to C-c C-f. Inside the function, the
- 9.8 Critical severity
versionn: Improper Neutralization of Special Elements used in a Command
versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to version 1.1.0. This issue is patched in version 1.1.0.
- 9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in a Command
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.
- 9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in a Command
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.
- 8.8 High severity
NSRW: Improper Neutralization of Special Elements used in an OS Command
NetModule NSRW web administration interface executes an OS command constructed with unsanitized user input. A successful exploit could allow an authenticated user to execute arbitrary commands with elevated privileges. This issue affects NSRW: from 4.3.0.0 bef
- 9.8 Critical severity
WNDR3700v2: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in Netgear WNDR3700v2 1.0.1.14 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has
- 8.8 High severity
Splunk Enterprise: Improper Neutralization of Special Elements used in a Command
In Splunk Enterprise versions below 8.1.13, 8.2.10, and 9.0.4, the ‘display.page.search.patterns.sensitivity’ search parameter lets a search bypass SPL safeguards for risky commands. The vulnerability requires a higher privileged user to initiate a request wit