Improper Neutralization of Special Elements used in a Command
CWE-77
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
We track 2,127 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 41 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
Latest Improper Neutralization of Special Elements used in a Command vulnerabilities
- 8.8 High severity
EasyNAS: Improper Neutralization of Special Elements used in an OS Command
A vulnerability classified as critical has been found in EasyNAS 1.1.0. Affected is the function system of the file /backup.pl. The manipulation leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the
- 7.8 High severity
D-Link DWL-2600AP with firmware v4.2.0.17: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the firmware_update command, in the device's restricted telnet interface, allows an authenticated attacker to execute arbitrary commands as root.
- 10.0 Critical severity
Nova 436Q: Improper Neutralization of Special Elements used in a Command
Baicells Nova 436Q, Nova 430E, Nova 430I, and Neutrino 430 LTE TDD eNodeB devices with firmware through QRTB 2.12.7 are vulnerable to remote shell code exploitation via HTTP command injections. Commands are executed using pre-login execution and executed with
- 8.8 High severity
Unisphere for PowerMax vApp: Improper Neutralization of Special Elements used in an OS Command
Dell Unisphere for PowerMax vApp, VASA Provider vApp, and Solution Enabler vApp version 9.2.3.x contain a command execution vulnerability. A low privileged remote attacker could potentially exploit this vulnerability, leading to execute arbitrary commands on t
- 9.8 Critical severity
https://github.com/jitsi: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote execution.
- 9.8 Critical severity
Solarview Compact Firmware: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.
- 9.8 Critical severity
A7100ru Firmware: Improper Neutralization of Special Elements used in a Command
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.
- 9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
- 9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
- 9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
- 9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
- 9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
- 9.8 Critical severity
T8 Firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
- 9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function.
- 9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function.
- 9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetworkDiag function.
- 9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function.
- 9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function.
- 9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function.
- 9.8 Critical severity
Ca300-poe Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function.
- 7.5 High severity
dst-admin: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in dst-admin 1.5.0 and classified as critical. This vulnerability affects unknown code of the file /home/sendBroadcast. The manipulation of the argument message leads to command injection. The attack can be initiated remotely. Th
- 7.5 High severity
dst-admin: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, was found in dst-admin 1.5.0. This affects an unknown part of the file /home/masterConsole. The manipulation of the argument command leads to command injection. It is possible to initiate the attack remotely.
- 7.5 High severity
dst-admin: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, has been found in dst-admin 1.5.0. Affected by this issue is some unknown functionality of the file /home/kickPlayer. The manipulation of the argument userId leads to command injection. The attack may be launc
- 7.5 High severity
dst-admin: Improper Neutralization of Special Elements used in a Command
A vulnerability classified as critical was found in dst-admin 1.5.0. Affected by this vulnerability is an unknown functionality of the file /home/cavesConsole. The manipulation of the argument command leads to command injection. The attack can be launched remo
- 9.8 Critical severity
TEW-652BRP: Improper Neutralization of Special Elements used in a Command
A vulnerability was found in TRENDnet TEW-652BRP 3.04b01. It has been classified as critical. Affected is an unknown function of the file ping.ccp of the component Web Interface. The manipulation leads to command injection. It is possible to launch the attack
- 9.8 Critical severity
TEW-811DRU: Improper Neutralization of Special Elements used in a Command
A vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit ha
- 7.8 High severity
F5OS-A: Improper Neutralization of Special Elements used in a Command
On F5OS-A beginning in version 1.2.0 to before 1.3.0 and F5OS-C beginning in version 1.3.0 to before 1.5.0, processing F5OS tenant file names may allow for command injection. Note: Software versions which have reached End of Technical Support (EoTS) are not ev
- 8.8 High severity
TEW-652BRP: Improper Neutralization of Special Elements used in a Command
A vulnerability, which was classified as critical, has been found in TRENDnet TEW-652BRP 3.04B01. This issue affects some unknown processing of the file get_set.ccp of the component Web Management Interface. The manipulation leads to command injection. The att
- 7.8 High severity
mt7688-wiscan: Improper Neutralization of Special Elements used in an OS Command
Versions of the package mt7688-wiscan before 0.8.3 are vulnerable to Command Injection due to improper input sanitization in the 'wiscan.scan' function.
- 9.8 Critical severity
nemo-appium: Improper Neutralization of Special Elements used in an OS Command
Versions of the package nemo-appium before 0.0.9 are vulnerable to Command Injection due to improper input sanitization in the 'module.exports.setup' function. **Note:** In order to exploit this vulnerability appium-running 0.1.3 has to be installed as one of
- 9.8 Critical severity
create-choo-electron: Improper Neutralization of Special Elements used in an OS Command
All versions of the package create-choo-electron are vulnerable to Command Injection via the devInstall function due to improper user-input sanitization.
- 9.8 Critical severity
Apache Airflow: Improper Neutralization of Special Elements used in a Command
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: before 2.5.1; Apache Air
- 7.2 High severity
A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260…
A vulnerability in the web-based management interface of Cisco Small Business RV160 and RV260 Series VPN Routers could allow an authenticated, remote attacker to execute arbitrary commands on the underlying operating system of an affected device. This vulnerab
- 7.2 High severity
A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042…
A vulnerability in the web-based management interface of Cisco Small Business RV016, RV042, RV042G, RV082, RV320 and RV325 Routers could allow an authenticated, remote attacker to execute arbitrary commands on an affected device. This vulnerability is due to i
- 9.8 Critical severity
netdata: Improper Neutralization of Special Elements used in a Command
Netdata is an open source option for real-time infrastructure monitoring and troubleshooting. An attacker with the ability to establish a streaming connection can execute arbitrary commands on the targeted Netdata agent. When an alert is triggered, the functio
- 8.8 High severity
Autolab: Improper Neutralization of Special Elements used in a Command
Autolab is a course management service, initially developed by a team of students at Carnegie Mellon University, that enables instructors to offer autograded programming assignments to their students over the Web. A remote code execution vulnerability was disc
- 9.8 Critical severity
global-modules-path: Improper Neutralization of Special Elements used in an OS Command
Versions of the package global-modules-path before 3.0.0 are vulnerable to Command Injection due to missing input sanitization or other checks and sandboxes being employed to the getPath function.
- 9.1 Critical severity
4G Router DX-3021: Improper Neutralization of Special Elements used in a Command
The webserver in Delta DX-3021 versions prior to 1.24 is vulnerable to command injection through the network diagnosis page. This vulnerability could allow a remote unauthenticated user to add files, delete files, and change file permissions.
- 8.8 High severity
SINEC INS: Improper Neutralization of Special Elements used in a Command
A vulnerability has been identified in SINEC INS (All versions < V1.0 SP2 Update 1). An authenticated remote attacker with access to the Web Based Management (443/tcp) of the affected product, could potentially inject commands into the dhcpd configuration of t
- 9.8 Critical severity
MF286R: Improper Neutralization of Special Elements used in a Command
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.