CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

ClassDraftLikelihood: High

Description

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

CWE-74

Children

Related attack patterns (CAPEC)

CAPEC-136 · CAPEC-15 · CAPEC-183 · CAPEC-248 · CAPEC-40 · CAPEC-43 · CAPEC-75 · CAPEC-76

CVEs mapped to this weakness (3,816)

page 26 of 191

CVE	Vendor / Product	Sev	Risk	CVSS	EPSS	Published	Description
CVE-2023-46417	Totolink X6000R	Cri	0.64	9.8	0.02	Oct 25, 2023	TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function.
CVE-2023-46416	Totolink X6000R	Cri	0.64	9.8	0.02	Oct 25, 2023	TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function.
CVE-2023-46415	Totolink X6000R	Cri	0.64	9.8	0.02	Oct 25, 2023	TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function.
CVE-2023-46414	Totolink X6000R	Cri	0.64	9.8	0.02	Oct 25, 2023	TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function.
CVE-2023-46413	Totolink X6000R	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function.
CVE-2023-46412	Totolink X6000R	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function.
CVE-2023-46411	Totolink X6000R	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function.
CVE-2023-46410	Totolink X6000R	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function.
CVE-2023-46409	Totolink X6000R	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function.
CVE-2023-46408	Totolink X6000R	Cri	0.64	9.8	0.01	Oct 25, 2023	TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function.
CVE-2023-36954	Totolink CP300	Cri	0.64	9.8	0.02	Oct 16, 2023	TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVE-2023-36953	Totolink CP300	Cri	0.64	9.8	0.02	Oct 16, 2023	TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVE-2023-45466	Netis N3Mv2	Cri	0.64	9.8	0.02	Oct 13, 2023	Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings.
CVE-2023-45465	Netis N3Mv2	Cri	0.64	9.8	0.02	Oct 13, 2023	Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings.
CVE-2023-43891	Netis N3Mv2	Cri	0.64	9.8	0.02	Oct 2, 2023	Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploited via a crafted payload.
CVE-2023-43128	Dlink DIR-806	Cri	0.64	9.8	0.02	Sep 21, 2023	D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters.
CVE-2023-43207	Dlink DWL-6610	Cri	0.64	9.8	0.02	Sep 20, 2023	D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vulnerability allows attackers to execute arbitrary commands via the configRestore parameter.
CVE-2023-43206	Dlink DWL-6610	Cri	0.64	9.8	0.02	Sep 20, 2023	D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerability allows attackers to execute arbitrary commands via the certDownload parameter.
CVE-2023-43204	Dlink DWL-6610	Cri	0.64	9.8	0.02	Sep 20, 2023	D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter.
CVE-2023-43202	Dlink DWL-6610	Cri	0.64	9.8	0.02	Sep 20, 2023	D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerability allows attackers to execute arbitrary commands via the update.device.packet-capture.tftp-file-name parameter.

CVE-2023-46417CriOct 25, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_415498 function.
CVE-2023-46416CriOct 25, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ The 41A414 function.
CVE-2023-46415CriOct 25, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_41E588 function.
CVE-2023-46414CriOct 25, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.02
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a remote command execution (RCE) vulnerability via the sub_ 41D494 function.
CVE-2023-46413CriOct 25, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_4155DC function.
CVE-2023-46412CriOct 25, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_41D998 function.
CVE-2023-46411CriOct 25, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_415258 function.
CVE-2023-46410CriOct 25, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 416F60 function.
CVE-2023-46409CriOct 25, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ 41CC04 function.
CVE-2023-46408CriOct 25, 2023
Totolink
X6000R
risk 0.64cvss 9.8epss 0.01
TOTOLINK X6000R v9.4.0cu.652_B20230116 was discovered to contain a command execution vulnerability via the sub_ The 41DD80 function.
CVE-2023-36954CriOct 16, 2023
Totolink
CP300
risk 0.64cvss 9.8epss 0.02
TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVE-2023-36953CriOct 16, 2023
Totolink
CP300
risk 0.64cvss 9.8epss 0.02
TOTOLINK CP300+ V5.2cu.7594_B20200910 and before is vulnerable to command injection.
CVE-2023-45466CriOct 13, 2023
Netis
N3Mv2
risk 0.64cvss 9.8epss 0.02
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the pin_host parameter in the WPS Settings.
CVE-2023-45465CriOct 13, 2023
Netis
N3Mv2
risk 0.64cvss 9.8epss 0.02
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability via the ddnsDomainName parameter in the Dynamic DNS settings.
CVE-2023-43891CriOct 2, 2023
Netis
N3Mv2
risk 0.64cvss 9.8epss 0.02
Netis N3Mv2-V1.0.1.865 was discovered to contain a command injection vulnerability in the Changing Username and Password function. This vulnerability is exploited via a crafted payload.
CVE-2023-43128CriSep 21, 2023
Dlink
DIR-806
risk 0.64cvss 9.8epss 0.02
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters.
CVE-2023-43207CriSep 20, 2023
Dlink
DWL-6610
risk 0.64cvss 9.8epss 0.02
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vulnerability allows attackers to execute arbitrary commands via the configRestore parameter.
CVE-2023-43206CriSep 20, 2023
Dlink
DWL-6610
risk 0.64cvss 9.8epss 0.02
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerability allows attackers to execute arbitrary commands via the certDownload parameter.
CVE-2023-43204CriSep 20, 2023
Dlink
DWL-6610
risk 0.64cvss 9.8epss 0.02
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter.
CVE-2023-43202CriSep 20, 2023
Dlink
DWL-6610
risk 0.64cvss 9.8epss 0.02
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerability allows attackers to execute arbitrary commands via the update.device.packet-capture.tftp-file-name parameter.