Improper Neutralization of Special Elements used in a Command
CWE-77
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
Many protocols and products have their own custom command language. While OS or shell command strings are frequently discovered and targeted, developers may not realize that these other command languages might also be vulnerable to attacks.
We track 2,129 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.8. 41 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: If at all possible, use library calls rather than external processes to recreate the desired functionality.
- Implementation: If possible, ensure that all external commands called from the program are statically created.
- Operation: Run time: Run time policy enforcement may be used in an allowlist fashion to prevent use of any non-sanctioned commands.
- System Configuration: Assign permissions that prevent the user from accessing/opening privileged files.
Latest Improper Neutralization of Special Elements used in a Command vulnerabilities
- 7.8 High severity
Powerline Gitstatus: Improper Neutralization of Special Elements used in a Command
powerline-gitstatus (aka Powerline Gitstatus) before 1.3.2 allows arbitrary code execution. git repositories can contain per-repository configuration that changes the behavior of git, including running arbitrary commands. When using powerline-gitstatus, changi
- 9.8 Critical severity
Arrayos Ag: Improper Neutralization of Special Elements used in a Command
Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and control of the system. NOTE: ArrayOS AG 10.x is unaffected.
- 8.2 High severity
Dell Hybrid Client (DHC): Improper Neutralization of Special Elements used in a Command
Dell Hybrid Client below 1.8 version contains a gedit vulnerability. A guest attacker could potentially exploit this vulnerability, allowing deletion of user and some system files and folders.
- 7.2 High severity
mybb: Improper Neutralization of Special Elements used in a Command
MyBB is a free and open source forum software. The _Mail Settings_ → Additional Parameters for PHP's mail() function mail_parameters setting value, in connection with the configured mail program's options and behavior, may allow access to sensitive information
- 7.2 High severity
Cisco IOS XE Software: Improper Neutralization of Special Elements used in an OS Command
A vulnerability in the web UI feature of Cisco IOS XE Software could allow an authenticated, remote attacker to perform an injection attack against an affected device. This vulnerability is due to insufficient input validation. An attacker could exploit this v
- 9.8 Critical severity
NuProcess: Improper Neutralization of Special Elements used in a Command
NuProcess is an external process execution implementation for Java. In all the versions of NuProcess where it forks processes by using the JVM's Java_java_lang_UNIXProcess_forkAndExec method (1.2.0+), attackers can use NUL characters in their strings to perfor
- 7.2 High severity
Aruba ClearPass Policy Manager: Improper Neutralization of Special Elements used in a Command
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlyi
- 7.2 High severity
Aruba ClearPass Policy Manager: Improper Neutralization of Special Elements used in a Command
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlyi
- 7.2 High severity
Aruba ClearPass Policy Manager: Improper Neutralization of Special Elements used in a Command
Vulnerabilities in the ClearPass Policy Manager web-based management interface allow remote authenticated users to run arbitrary commands on the underlying host. A successful exploit could allow an attacker to execute arbitrary commands as root on the underlyi
- 7.5 High severity
Apache James: Improper Neutralization of Special Elements used in a Command
Apache James prior to release 3.6.3 and 3.7.1 is vulnerable to a buffering attack relying on the use of the STARTTLS command. Fix of CVE-2021-38542, which solved similar problem fron Apache James 3.6.1, is subject to a parser differential and do not take into
- 8.8 High severity
tinygltf: Improper Neutralization of Special Elements used in a Command
The tinygltf library uses the C library function wordexp() to perform file path expansion on untrusted paths that are provided from the input file. This function allows for command injection by using backticks. An attacker could craft an untrusted path input t
- 8.2 High severity
Edge Gateway 5200: Improper Neutralization of Special Elements used in an OS Command
Dell Edge Gateway 5200 (EGW) versions before 1.03.10 contain an operating system command injection vulnerability. A local malicious user may potentially exploit this vulnerability by using an SMI to bypass PMC mitigation and gain arbitrary code execution durin
- 9.8 Critical severity
iSTAR Ultra: Improper Neutralization of Special Elements used in a Command
All versions of iSTAR Ultra prior to version 6.8.9.CU01 are vulnerable to a command injection that could allow an unauthenticated user root access to the system.
- 9.8 Critical severity
Skybridge Mb-a100 Firmware: Improper Neutralization of Special Elements used in a Command
Seiko SkyBridge MB-A100/A110 v4.2.0 and below was discovered to contain a command injection vulnerability via the ipAddress parameter at 07system08execute_ping_01.
- 9.8 Critical severity
Hwl-2511-ss Firmware: Improper Neutralization of Special Elements used in a Command
A command injection vulnerability in the CLI (Command Line Interface) implementation of Hytec Inter HWL-2511-SS v1.05 and below allows attackers to execute arbitrary commands with root privileges.
- 9.8 Critical severity
Wn572hp3 Firmware: Improper Neutralization of Special Elements used in a Command
WAVLINK WN572HP3, WN533A8, WN530H4, WN535G3, WN531P3 nas.cgi has no filtering on parameters: User1Passwd and User1, which leads to command injection in page /nas_disk.shtml.
- 8.8 High severity
Android: Out-of-bounds Write
In l2cble_process_sig_cmd of l2c_ble.cc, there is a possible out of bounds write due to a missing bounds check. This could lead to remote code execution over Bluetooth with no additional execution privileges needed. User interaction is not needed for exploitat
- 9.8 Critical severity
Teamcenter V12.4: Improper Neutralization of Special Elements used in a Command
A vulnerability has been identified in Teamcenter V12.4 (All versions < V12.4.0.15), Teamcenter V13.0 (All versions < V13.0.0.10), Teamcenter V13.1 (All versions < V13.1.0.10), Teamcenter V13.2 (All versions < V13.2.0.9), Teamcenter V13.3 (All versions < V13.3
- 8.8 High severity
SonicWall Switch: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a user input allows an authenticated malicious user to perform remote code execution in the host system. This vulnerability impacts SonicWall Switch 1.1.1.0-2s and earlier versions
- 9.8 Critical severity
RMC-100 (Standard): Improper Limitation of a Pathname to a Restricted Directory
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal'), Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in flow computer and remote controller products of ABB ( RMC-100 (Standard), RMC-1
- 9.8 Critical severity
roxy-wi: Unrestricted Upload of File with Dangerous Type
Roxy-WI is a Web interface for managing HAProxy, Nginx and Keepalived servers. Prior to version 6.1.1.0, the system command can be run remotely via the subprocess_execute function without processing the inputs received from the user in the /app/options.py file
- 9.8 Critical severity
SIMATIC CP 1242-7 V2: Improper Encoding or Escaping of Output
A vulnerability has been identified in SIMATIC CP 1242-7 V2 (All versions < V3.3.46), SIMATIC CP 1243-1 (All versions < V3.3.46), SIMATIC CP 1243-7 LTE EU (All versions < V3.3.46), SIMATIC CP 1243-7 LTE US (All versions < V3.3.46), SIMATIC CP 1243-8 IRC (All v
- 7.2 High severity
RUGGEDCOM ROX MX5000: Improper Neutralization of Special Elements used in a Command
A vulnerability has been identified in RUGGEDCOM ROX MX5000 (All versions < 2.15.1), RUGGEDCOM ROX MX5000RE (All versions < 2.15.1), RUGGEDCOM ROX RX1400 (All versions < 2.15.1), RUGGEDCOM ROX RX1500 (All versions < 2.15.1), RUGGEDCOM ROX RX1501 (All versions
- 9.8 Critical severity
Wl-wn575a3 Firmware: Improper Neutralization of Special Elements used in a Command
Wavlink WL-WN575A3 RPT75A3.V4300.201217 was discovered to contain a command injection vulnerability via the function obtw. This vulnerability allows attackers to execute arbitrary commands via a crafted POST request.
- 9.8 Critical severity
Ex300 V2 Firmware: Improper Neutralization of Special Elements used in a Command
TOTOLINK EX300_V2 V4.0.3c.7484 was discovered to contain a command injection vulnerability via the langType parameter in the setLanguageCfg function. This vulnerability is exploitable via a crafted MQTT data packet.
- 7.2 High severity
A830r Firmware: Improper Neutralization of Special Elements used in a Command
Totolink A830R V5.9c.4729_B20191112, Totolink A3100R V4.1.2cu.5050_B20200504, Totolink A950RG V4.1.2cu.5161_B20200903, Totolink A800R V4.1.2cu.5137_B20200730, Totolink A3000RU V5.9c.5185_B20201128, Totolink A810R V4.1.2cu.5182_B20201026 were discovered to cont
- 9.8 Critical severity
DS-A71024/48/72R,DS-A80624S,DS-A81016S,DS-A7202…: Improper Neutralization of Special Elements used in a Command
The web module in some Hikvision Hybrid SAN/Cluster Storage products have the following security vulnerability. Due to the insufficient input validation, attacker can exploit the vulnerability to execute restricted commands by sending messages with malicious c
- 8.1 High severity
Splunk Enterprise: Improper Neutralization of Special Elements used in a Command
Dashboards in Splunk Enterprise versions before 9.0 might let an attacker inject risky search commands into a form token when the token is used in a query in a cross-origin request. The result bypasses SPL safeguards for risky commands. See New capabilities ca
- 9.8 Critical severity
SINEMA Remote Connect Server: Improper Neutralization of Special Elements used in a Command
A vulnerability has been identified in SINEMA Remote Connect Server (All versions < V3.1). The affected application contains a file upload server that is vulnerable to command injection. An attacker could use this to achieve arbitrary code execution.
- 8.6 High severity
Go-getter: Improper Limitation of a Pathname to a Restricted Directory
go-getter up to 1.5.11 and 2.0.2 allowed arbitrary host access via go-getter path traversal, symlink processing, and command injection flaws. Fixed in 1.6.1 and 2.1.0.
- 9.8 Critical severity
HPE Nimble Storage Hybrid Flash Arrays; Nimble…: Improper Neutralization of Special Elements used in a Command
A command injection security vulnerability has been identified in HPE Nimble Storage Hybrid Flash Arrays, HPE Nimble Storage All Flash Arrays and HPE Nimble Storage Secondary Flash Arrays that could allow an attacker to execute arbitrary commands on a Nimble a
- 8.8 High severity
gocd: Improper Neutralization of Special Elements used in a Command
GoCD is a continuous delivery server. In GoCD versions prior to 22.1.0, it is possible for existing authenticated users who have permissions to edit or create pipeline materials or pipeline configuration repositories to get remote code execution capability on
- 8.8 High severity
Fidelis Network: Improper Neutralization of Special Elements used in a Command
Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “update_checkfile” value for the “filename” parameter. The vulnerability could allow a specially crafted HTTP request to exec
- 8.8 High severity
Fidelis Network: Improper Neutralization of Special Elements used in a Command
Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “check_vertica_upgrade” value for the “cpIp” parameter. The vulnerability could allow a specially crafted HTTP request to exe
- 8.8 High severity
Fidelis Network: Improper Neutralization of Special Elements used in a Command
Vulnerability in Fidelis Network and Deception CommandPost enables authenticated command injection through the web interface using the “feed_comm_test” value for the “feed” parameter. The vulnerability could allow a specially crafted HTTP request to execute sy
- 8.8 High severity
Fidelis Network: Improper Neutralization of Special Elements used in a Command
Vulnerability in rconfig “remote_text_file” enables an attacker with user level access to the CLI to inject user level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components.
- 8.8 High severity
Fidelis Network: Improper Neutralization of Special Elements used in a Command
Vulnerability in rconfig “cert_utils” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The v
- 8.8 High severity
Fidelis Network: Improper Neutralization of Special Elements used in a Command
Vulnerability in rconfig “date” enables an attacker with user level access to the CLI to inject root level commands into Fidelis Network and Deception CommandPost, Collector, Sensor, and Sandbox components as well as neighboring Fidelis components. The vulnera
- 8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in the httpd wlscan_ASP functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted HTTP request can lead to arbitrary command execution. An attacker can make an authenticated HTTP request to trigger th
- 8.8 High severity
InRouter302: Improper Neutralization of Special Elements used in an OS Command
An OS command injection vulnerability exists in the daretools binary functionality of InHand Networks InRouter302 V3.5.4. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence of requests to trigger this v