VYPR

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88

CVEs mapped to this weakness (6,573)

page 134 of 329
  • CVE-2023-41200HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticPrefixLength Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not…

  • CVE-2023-41199HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticDNS2 Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to…

  • CVE-2023-41198HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticDNS1 Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to…

  • CVE-2023-41197HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticDefaultGateway Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not…

  • CVE-2023-41196HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticAddress Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required…

  • CVE-2023-41195HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetHostIPv6Settings IPv6Mode Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit…

  • CVE-2023-41194HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetAPLanSettings SubnetMask Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit…

  • CVE-2023-41193HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetAPLanSettings SecondaryDNS Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to…

  • CVE-2023-41192HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetAPLanSettings PrimaryDNS Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit…

  • CVE-2023-41191HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetAPLanSettings Mode Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this…

  • CVE-2023-41190HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetAPLanSettings IPAddr Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this…

  • CVE-2023-41189HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetAPLanSettings Gateway Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit…

  • CVE-2023-41188HigMay 3, 2024
    Dlink
    DAP-1325
    risk 0.57cvss 8.8epss 0.01

    D-Link DAP-1325 HNAP SetAPLanSettings DeviceName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit…

  • CVE-2023-40480HigMay 3, 2024
    Netgear
    RAX30
    risk 0.57cvss 8.8epss 0.01

    NETGEAR RAX30 DHCP Server Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The…

  • CVE-2023-40479HigMay 3, 2024
    Netgear
    RAX30
    risk 0.57cvss 8.8epss 0.01

    NETGEAR RAX30 UPnP Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The…

  • CVE-2023-39471HigMay 3, 2024
    TP-Link
    Tl Wr840n Firmware
    risk 0.57cvss 8.8epss 0.01

    TP-Link TL-WR841N ated_tp Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of TP-Link TL-WR841N routers. Authentication is not required to exploit this vulnerability. …

  • CVE-2023-38120HigMay 3, 2024
    Adtran
    SR400ac
    risk 0.57cvss 8.8epss 0.04

    Adtran SR400ac ping Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Adtran SR400ac routers. Although authentication is required to exploit this vulnerability, the existing…

  • CVE-2023-35723HigMay 3, 2024
    Dlink
    DIR-X3260
    risk 0.57cvss 8.8epss 0.01

    D-Link DIR-X3260 prog.cgi SOAPAction Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Authentication is not required to exploit this…

  • CVE-2023-35722HigMay 3, 2024
    Netgear
    RAX30
    risk 0.57cvss 8.8epss 0.01

    NETGEAR RAX30 UPnP Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to exploit this vulnerability. The…

  • CVE-2023-34279HigMay 3, 2024
    Dlink
    DIR-2150
    risk 0.57cvss 8.8epss 0.01

    D-Link DIR-2150 GetDeviceSettings Target Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Authentication is not required to exploit this…