VYPR

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88

CVEs mapped to this weakness (7,107)

page 193 of 356
  • CVE-2024-41317HigJul 22, 2024
    Totolink
    A6000R
    risk 0.52cvss 8.0epss 0.02

    TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pbc_wps function.

  • CVE-2024-5785HigJun 10, 2024
    Comtrend
    GRG-4280us
    risk 0.52cvss 8.0epss 0.01

    Command injection vulnerability in Comtrend router WLD71-T1_v2.0.201820, affecting the GRG-4280us version. This vulnerability could allow an authenticated user to execute commands inside the router by making a POST request to the URL “/boaform/admin/formUserTracert”.

  • CVE-2023-51625HigMay 3, 2024
    Dlink
    DCS-8300LHV2
    risk 0.52cvss 8.0epss 0.02

    D-Link DCS-8300LHV2 ONVIF SetSystemDateAndTime Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DCS-8300LHV2 IP cameras. Although authentication is required…

  • CVE-2023-44427HigMay 3, 2024
    Dlink
    DIR-X3260
    risk 0.52cvss 8.0epss 0.01

    D-Link DIR-X3260 SetSysEmailSettings SMTPServerAddress Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required…

  • CVE-2023-44426HigMay 3, 2024
    Dlink
    DIR-X3260
    risk 0.52cvss 8.0epss 0.01

    D-Link DIR-X3260 SetSysEmailSettings AccountPassword Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required…

  • CVE-2023-44425HigMay 3, 2024
    Dlink
    DIR-X3260
    risk 0.52cvss 8.0epss 0.02

    D-Link DIR-X3260 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to…

  • CVE-2023-44424HigMay 3, 2024
    Dlink
    DIR-X3260
    risk 0.52cvss 8.0epss 0.02

    D-Link DIR-X3260 SetSysEmailSettings EmailTo Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to…

  • CVE-2023-44423HigMay 3, 2024
    Dlink
    DIR-X3260
    risk 0.52cvss 8.0epss 0.02

    D-Link DIR-X3260 SetTriggerPPPoEValidate Password Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to…

  • CVE-2023-44422HigMay 3, 2024
    Dlink
    DIR-X3260
    risk 0.52cvss 8.0epss 0.02

    D-Link DIR-X3260 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to…

  • CVE-2023-44421HigMay 3, 2024
    Dlink
    DIR-X3260
    risk 0.52cvss 8.0epss 0.02

    D-Link DIR-X3260 SetTriggerPPPoEValidate Username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-X3260 routers. Although authentication is required to…

  • CVE-2023-44415HigMay 3, 2024
    Dlink
    DIR-1260
    risk 0.52cvss 8.0epss 0.01

    D-Link Multiple Routers cli Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-1260 and DIR-2150 routers. Authentication is required to exploit this…

  • CVE-2023-42128HigMay 3, 2024
    Magnet Forensics
    AXIOM
    risk 0.52cvss 8.0epss 0.01

    Magnet Forensics AXIOM Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Magnet Forensics AXIOM. User interaction is required to exploit this vulnerability in that…

  • CVE-2023-34281HigMay 3, 2024
    Dlink
    DIR-2150
    risk 0.52cvss 8.0epss 0.02

    D-Link DIR-2150 GetFirmwareStatus Target Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit…

  • CVE-2023-34280HigMay 3, 2024
    Dlink
    DIR-2150
    risk 0.52cvss 8.0epss 0.02

    D-Link DIR-2150 SetSysEmailSettings EmailTo Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit…

  • CVE-2023-34278HigMay 3, 2024
    Dlink
    DIR-2150
    risk 0.52cvss 8.0epss 0.02

    D-Link DIR-2150 SetSysEmailSettings EmailFrom Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to…

  • CVE-2023-34277HigMay 3, 2024
    Dlink
    DIR-2150
    risk 0.52cvss 8.0epss 0.02

    D-Link DIR-2150 SetSysEmailSettings AccountName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to…

  • CVE-2023-34276HigMay 3, 2024
    Dlink
    DIR-2150
    risk 0.52cvss 8.0epss 0.02

    D-Link DIR-2150 SetTriggerPPPoEValidate Username Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to…

  • CVE-2023-34275HigMay 3, 2024
    Dlink
    DIR-2150
    risk 0.52cvss 8.0epss 0.02

    D-Link DIR-2150 SetNTPServerSettings Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DIR-2150 routers. Although authentication is required to exploit this…

  • CVE-2023-27367HigMay 3, 2024
    Netgear
    RAX30
    risk 0.52cvss 8.0epss 0.01

    NETGEAR RAX30 libcms_cli Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Although authentication is required to exploit this vulnerability,…

  • CVE-2023-27356HigMay 3, 2024
    Netgear
    RAX30
    risk 0.52cvss 8.0epss 0.01

    NETGEAR RAX30 logCtrl Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Although authentication is required to exploit this vulnerability, the…