VYPR

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88

CVEs mapped to this weakness (2,292)

page 1 of 115
  • CVE-2018-10562CriKEVMay 4, 2018
    Dasan
    GPON home routers
    risk 0.93cvss 9.8epss 1.00

    An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html,…

  • CVE-2018-11138CriKEVMay 31, 2018
    Quest
    Kace Systems Management Appliance
    risk 0.92cvss 9.8epss 0.92

    The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by anonymous users and can be abused to execute arbitrary commands on the system.

  • CVE-2018-6530CriKEVMar 6, 2018
    Dlink
    DIR-868L
    risk 0.89cvss 9.8epss 0.97

    OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions, DIR-868L DIR868LA1_FW112b04 and previous versions, DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions, and…

  • CVE-2014-7169CriKEVSep 25, 2014
    GNU
    Bash
    risk 0.87cvss 9.8epss 1.00

    GNU Bash through 4.3 bash43-025 processes trailing strings after certain malformed function definitions in the values of environment variables, which allows remote attackers to write to files or possibly have unknown other impact via a crafted environment, as demonstrated by…

  • CVE-2014-6271CriKEVSep 24, 2014
    GNU
    Bash
    risk 0.87cvss 9.8epss 1.00

    GNU Bash through 4.3 processes trailing strings after function definitions in the values of environment variables, which allows remote attackers to execute arbitrary code via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH sshd,…

  • CVE-2018-14933CriKEVAug 4, 2018
    Nuuo
    Nvrmini 2
    risk 0.86cvss 9.8epss 0.94

    upgrade_handle.php on NUUO NVRmini devices allows Remote Command Execution via shell metacharacters in the uploaddir parameter for a writeuploaddir command.

  • CVE-2017-6077CriKEVFeb 22, 2017
    Netgear
    DGN2200
    risk 0.84cvss 9.8epss 0.68

    ping.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the ping_IPAddr field of an HTTP POST request.

  • CVE-2017-6884HigKEVApr 6, 2017
    Zyxel
    Emg2926 Firmware
    risk 0.81cvss 8.8epss 0.38

    A command injection vulnerability was discovered on the Zyxel EMG2926 home router with firmware V1.00(AAQT.4)b8. The vulnerability is located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute arbitrary commands…

  • CVE-2014-6278HigKEVSep 30, 2014
    GNU
    Bash
    risk 0.80cvss 8.8epss 1.00

    GNU Bash through 4.3 bash43-026 does not properly parse function definitions in the values of environment variables, which allows remote attackers to execute arbitrary commands via a crafted environment, as demonstrated by vectors involving the ForceCommand feature in OpenSSH…

  • CVE-2017-6334HigKEVMar 6, 2017
    Netgear
    Dgn2200 Firmware
    risk 0.78cvss 8.8epss 0.72

    dnslookup.cgi on NETGEAR DGN2200 devices with firmware through 10.0.0.50 allows remote authenticated users to execute arbitrary OS commands via shell metacharacters in the host_name field of an HTTP POST request, a different vulnerability than CVE-2017-6077.

  • CVE-2026-10520CriKEVJun 9, 2026
    Ivanti
    Sentry
    risk 0.77cvss 10.0epss 0.99

    An OS Command Injection vulnerability in Ivanti Sentry before the R10.5.2, R10.6.2 and R10.7.1 versions allows a remote unauthenticated user to achieve root-level remote code execution

  • CVE-2025-34037CriJun 24, 2025
    Nokia
    Series
    risk 0.75cvss —epss 0.85

    An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The CGI scripts improperly process user-supplied input passed to the ttcp_ip parameter without sanitization,…

  • CVE-2018-6961HigKEVJun 11, 2018
    VMware
    NSX SD-WAN Edge by VeloCloud
    risk 0.75cvss 8.1epss 0.86

    VMware NSX SD-WAN Edge by VeloCloud prior to version 3.1.0 contains a command injection vulnerability in the local web UI component. This component is disabled by default and should not be enabled on untrusted networks. VeloCloud by VMware will be removing this service from the…

  • CVE-2011-10017CriAug 13, 2025
    risk 0.74cvss —epss 0.02

    Snort Report versions < 1.3.2 contains a remote command execution vulnerability in the nmap.php and nbtscan.php scripts. These scripts fail to properly sanitize user input passed via the target GET parameter, allowing attackers to inject arbitrary shell commands. Exploitation…

  • CVE-2024-47407CriNov 22, 2024
    Scada Lts
    Mypro Manager
    risk 0.74cvss 10.0epss 0.64

    A parameter within a command does not properly validate input within myPRO Manager which could be exploited by an unauthenticated remote attacker to inject arbitrary operating system commands.

  • CVE-2018-14417CriAug 4, 2018
    SoftNAS
    SoftNAS Cloud
    risk 0.74cvss 9.8epss 0.90

    A command injection vulnerability was found in the web administration console in SoftNAS Cloud before 4.0.3. In particular, the snserv script did not sanitize the 'recentVersion' parameter from the snserv endpoint, allowing an unauthenticated attacker to execute arbitrary…

  • CVE-2017-17411CriDec 21, 2017
    Linksys
    WVBR0
    risk 0.74cvss 9.8epss 0.88

    This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper…

  • CVE-2009-20011CriAug 30, 2025
    Sophos
    Web Appliance
    risk 0.73cvss —epss 0.01

    ContentKeeper Web Appliance (now maintained by Impero Software) versions prior to 125.10 are vulnerable to remote command execution due to insecure handling of file uploads via the mimencode CGI utility. The vulnerability allows unauthenticated attackers to upload and execute…

  • CVE-2025-34112CriJul 15, 2025
    Riverbed
    SteelCentral NetProfiler
    risk 0.73cvss —epss 0.02

    An authenticated multi-stage remote code execution vulnerability exists in Riverbed SteelCentral NetProfiler and NetExpress 10.8.7 virtual appliances. A SQL injection vulnerability in the '/api/common/1.0/login' endpoint can be exploited to create a new user account in the…

  • CVE-2025-34073CriJul 2, 2025
    Stamparm
    Maltrail
    risk 0.73cvss —epss 0.04

    An unauthenticated command injection vulnerability exists in stamparm/maltrail (Maltrail) versions <=0.54. A remote attacker can execute arbitrary operating system commands via the username parameter in a POST request to the /login endpoint. This occurs due to unsafe handling of…