Improper Neutralization of Argument Delimiters in a Command
CWE-88
The product constructs a string for a command to be executed by a separate component in another control sphere, but it does not properly delimit the intended arguments, options, or switches within that command string.
We track 287 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.5. 5 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Understand all the potential areas where untrusted inputs can enter your product: parameters or arguments, cookies, anything read from the network, environment variables, request headers as well as content, URL components, e-mail, files, databases, and any external systems that provide data to the application. Perform input validation at well-defined interfaces.
- Implementation: Directly convert your input type into the expected data type, such as using a conversion function that translates a string into a number. After converting to the expected data type, ensure that the input's values fall within the expected range of allowable values and that multi-field consistencies are maintained.
- Implementation: When exchanging data between components, ensure that both components are using the same character encoding. Ensure that the proper encoding is applied at each interface. Explicitly set the encoding you are using whenever the protocol allows you to do so.
- Implementation: When your application combines data from multiple sources, perform the validation after the sources have been combined. The individual data elements may pass the validation step but violate the intended restrictions after they have been combined.
- Testing: Use dynamic tools and techniques that interact with the product using large test suites with many diverse inputs, such as fuzz testing (fuzzing), robustness testing, and fault injection. The product's operation may slow down, but it should not become unstable, crash, or generate incorrect results.
Latest Improper Neutralization of Argument Delimiters in a Command vulnerabilities
- 7.1 High severity
IPn4Gii / Bullet-LTE Firmware: Improper Neutralization of Argument Delimiters in a Command
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFRULE command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Arg
- 7.1 High severity
IPn4Gii / Bullet-LTE Firmware: Improper Neutralization of Argument Delimiters in a Command
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFPORTFWD command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of
- 7.1 High severity
IPn4Gii / Bullet-LTE Firmware: Improper Neutralization of Argument Delimiters in a Command
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFMAC command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argu
- 7.1 High severity
IPn4Gii / Bullet-LTE Firmware: Improper Neutralization of Argument Delimiters in a Command
Products that incorporate the Microhard BulletLTE-NA2 and IPn4Gii-NA2 are vulnerable to a post-authentication command injection issue in the AT+MFIP command that can lead to privilege escalation. This is an instance of CWE-88, "Improper Neutralization of Argum
- 7.8 High severity
Quantenna Wi-Fi chipset: Improper Neutralization of Argument Delimiters in a Command
The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the sync_time argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Inject
- 7.8 High severity
Quantenna Wi-Fi chipset: Improper Neutralization of Argument Delimiters in a Command
The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_syslog_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argum
- 7.8 High severity
Quantenna Wi-Fi chipset: Improper Neutralization of Argument Delimiters in a Command
The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the get_file_from_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argumen
- 7.8 High severity
Quantenna Wi-Fi chipset: Improper Neutralization of Argument Delimiters in a Command
The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the put_file_to_qtn argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument
- 7.8 High severity
Quantenna Wi-Fi chipset: Improper Neutralization of Argument Delimiters in a Command
The Quantenna Wi-Fi chipset ships with a local control script, router_command.sh (in the run_cmd argument), that is vulnerable to command injection. This is an instance of CWE-88, "Improper Neutralization of Argument Delimiters in a Command ('Argument Injectio
- 9.4 Critical severity
Atheos: Improper Neutralization of Special Elements used in an OS Command
Atheos is a self-hosted browser-based cloud integrated development environment. Prior to version 6.0.4, improper use of `escapeshellcmd()` in `/components/codegit/traits/execute.php` allows argument injection, leading to arbitrary command execution. Atheos adm
- 9.8 Critical severity
Niagara Framework: Improper Neutralization of Argument Delimiters in a Command
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Tridium Niagara Framework on QNX, Tridium Niagara Enterprise Security on QNX allows Command Delimiters. This issue affects Niagara Framework: before 4.14.2, bef
- 8.8 High severity
Checkmk: Improper Neutralization of Argument Delimiters in a Command
Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to write arbitrary files
- 8.8 High severity
jellyfin: Improper Neutralization of Argument Delimiters in a Command
Jellyfin is an open source self hosted media server. Versions before 10.10.7 are vulnerable to argument injection in FFmpeg. This can be leveraged to possibly achieve remote code execution by anyone with credentials to a low-privileged user. This vulnerability
- 9.1 Critical severity
Voyager: Improper Neutralization of Argument Delimiters in a Command
DevDojo Voyager 1.4.0 through 1.8.0, when Laravel 8 or later is used, allows authenticated administrators to execute arbitrary OS commands via a specific php artisan command.
- 7.8 High severity
Remote Full Client: Improper Neutralization of Argument Delimiters in a Command
Improper Neutralization of Argument Delimiters in the TeamViewer_service.exe component of TeamViewer Clients prior version 15.62 for Windows allows an attacker with local unprivileged access on a Windows system to elevate privileges via argument injection.
- 9.2 Critical severity
go-git: Improper Neutralization of Argument Delimiters in a Command
go-git is a highly extensible git implementation library written in pure Go. An argument injection vulnerability was discovered in go-git versions prior to v5.13. Successful exploitation of this vulnerability could allow an attacker to set arbitrary values to
- 7.1 High severity
PowerStore: Improper Neutralization of Argument Delimiters in a Command
Dell PowerStore contains an Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to modification of arbitrary system
- 7.2 High severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.4 allows a remote authenticated attacker with admin privileges to achieve remote code execution
- 9.1 Critical severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 9.1 Critical severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 9.1 Critical severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.7 and Ivanti Policy Secure before version 22.7R1.1 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 9.1 Critical severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.2 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.2 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.2 High severity
Connect Secure: Improper Neutralization of Argument Delimiters in a Command
Argument injection in Ivanti Connect Secure before version 22.7R2.1 and 9.1R18.9 and Ivanti Policy Secure before version 22.7R1.1 and 9.1R18.9 allows a remote authenticated attacker with admin privileges to achieve remote code execution.
- 7.5 High severity
framework: Improper Neutralization of Argument Delimiters in a Command
Laravel is a web application framework. When the register_argc_argv php directive is set to on , and users call any URL with a special crafted query string, they are able to change the environment used by the framework when handling the request. The vulnerabil
- 9.9 Critical severity
SINEC Security Monitor: Improper Neutralization of Argument Delimiters in a Command
A vulnerability has been identified in SINEC Security Monitor (All versions < V4.9.0). The affected application does not properly validate user input to the ```ssmctl-client``` command. This could allow an authenticated, lowly privileged remote attacker to exe
- 8.8 High severity
rust: Improper Neutralization of Argument Delimiters in a Command
Rust is a programming language. The fix for CVE-2024-24576, where `std::process::Command` incorrectly escaped arguments when invoking batch files on Windows, was incomplete. Prior to Rust version 1.81.0, it was possible to bypass the fix when the batch file na
- 7.2 High severity
Mitel SIP Phones Argument Injection Exploited
A vulnerability in the Mitel 6800 Series, 6900 Series, and 6900w Series SIP Phones, including the 6970 Conference Unit, through R6.4.0.HF1 (R6.4.0.136) could allow an authenticated attacker with administrative privilege to conduct an argument injection attack,
- 9.9 Critical severity
gogs: Improper Neutralization of Argument Delimiters in a Command
The built-in SSH server of Gogs through 0.13.0 allows argument injection in internal/ssh/ssh.go, leading to remote code execution. Authenticated attackers can exploit this by opening an SSH connection and sending a malicious --split-string env request if the b
- 9.8 Critical severity
Pandora FMS: Improper Neutralization of Argument Delimiters in a Command
Argument Injection Leading to Remote Code Execution in Realtime Graph Extension, allowing unauthenticated attackers to execute arbitrary code on the server. This issue affects Pandora FMS: from 700 through <777.
- 8.8 High severity
NetBox: Improper Neutralization of Argument Delimiters in a Command
LenelS2 NetBox access control and event monitoring system was discovered to contain an authenticated RCE in versions prior to and including 5.6.1, which allows an attacker to execute malicious commands.
- 8.8 High severity
Ignition: Improper Neutralization of Argument Delimiters in a Command
Inductive Automation Ignition getParams Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Inductive Automation Ignition. User interaction is required to exp
- 7.8 High severity
Xreader: Improper Neutralization of Argument Delimiters in a Command
Linux Mint Xreader CBT File Parsing Argument Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Linux Mint Xreader. User interaction is required to exploit this vulne
- 7.2 High severity
Enterprise Server: Improper Neutralization of Argument Delimiters in a Command
A server side request forgery vulnerability was identified in GitHub Enterprise Server that allowed an attacker with an editor role in the Management Console to gain admin access to the appliance when configuring the Artifacts & Logs and Migrations Storage. Ex
- 8.4 High severity
flatpak: Improper Neutralization of Argument Delimiters in a Command
Flatpak is a system for building, distributing, and running sandboxed desktop applications on Linux. in versions before 1.10.9, 1.12.9, 1.14.6, and 1.15.8, a malicious or compromised Flatpak app could execute arbitrary code outside its sandbox. Normally, the `
- 9.8 Critical severity
Shared library: Improper Neutralization of Argument Delimiters in a Command
HashiCorp’s go-getter library is vulnerable to argument injection when executing Git to discover remote branches. This vulnerability does not affect the go-getter/v2 branch and package.
- 7.5 High severity
a+HRD: Improper Neutralization of Argument Delimiters in a Command
aEnrich Technology a+HRD's functionality for downloading files using youtube-dl.exe does not properly restrict user input. This allows attackers to pass arbitrary arguments to youtube-dl.exe, leading to the download of partial unauthorized files.
- 10.0 Critical severity
rust: Improper Neutralization of Special Elements used in an OS Command
Rust is a programming language. The Rust Security Response WG was notified that the Rust standard library prior to version 1.77.2 did not properly escape arguments when invoking batch files (with the `bat` and `cmd` extensions) on Windows using the `Command`.
- 8.6 High severity
WS203VICM: Improper Neutralization of Argument Delimiters in a Command
A remote, unauthenticated attacker may be able to send crafted messages to the web server of the Commend WS203VICM causing the system to restart, interrupting service.
- 7.2 High severity
Cisco Business Wireless Access Point Software: Improper Neutralization of Special Elements used in a Command
A vulnerability in the web-based management interface of the Cisco WAP371 Wireless-AC/N Dual Radio Access Point (AP) with Single Point Setup could allow an authenticated, remote attacker to perform command injection attacks against an affected device. This vul
- 9.8 Critical severity
LearnPress – WordPress LMS Plugin for Create…: Improper Neutralization of Special Elements used in a Command
The LearnPress plugin for WordPress is vulnerable to Command Injection in all versions up to, and including, 4.2.5.7 via the get_content function. This is due to the plugin making use of the call_user_func function with user input. This makes it possible for u