VYPR

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

BaseStableLikelihood: High

Description

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Hierarchy (View 1000)

Parents

Children

none

Related attack patterns (CAPEC)

CAPEC-108 · CAPEC-15 · CAPEC-43 · CAPEC-6 · CAPEC-88

CVEs mapped to this weakness (6,475)

page 274 of 324
  • CVE-2025-2095MedMar 7, 2025
    Totolink
    EX1800T
    risk 0.41cvss 6.3epss 0.03

    A vulnerability classified as critical has been found in TOTOLINK EX1800T 9.1.0cu.2112_B20220316. This affects the function setDmzCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument ip leads to os command injection. It is possible to initiate the attack…

  • CVE-2025-1819MedMar 2, 2025
    Tenda
    AC7 1200M
    risk 0.41cvss 6.3epss 0.02

    A vulnerability, which was classified as critical, was found in Tenda AC7 1200M 15.03.06.44. Affected is the function TendaTelnet of the file /goform/telnet. The manipulation of the argument lan_ip leads to os command injection. It is possible to launch the attack remotely. The…

  • CVE-2025-1676MedFeb 25, 2025
    Hzmanyun
    Education And Training System
    risk 0.41cvss 6.3epss 0.02

    A vulnerability classified as critical was found in hzmanyun Education and Training System 3.1.1. Affected by this vulnerability is the function pdf2swf of the file /pdf2swf. The manipulation of the argument file leads to os command injection. The attack can be launched…

  • CVE-2025-1339MedFeb 16, 2025
    Totolink
    X18
    risk 0.41cvss 6.3epss 0.03

    A vulnerability was found in TOTOLINK X18 9.1.0cu.2024_B20220329. It has been rated as critical. This issue affects the function setL2tpdConfig of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may be initiated…

  • CVE-2025-1229MedFeb 12, 2025
    Loggrove
    Loggrove
    risk 0.41cvss 6.3epss 0.01

    A vulnerability classified as critical was found in olajowon Loggrove up to e428fac38cc480f011afcb1d8ce6c2bad378ddd6. Affected by this vulnerability is an unknown functionality of the file /read/?page=1&logfile=eee&match=. The manipulation of the argument path leads to os…

  • CVE-2024-12985MedDec 27, 2024
    Overtek
    OT-E801G
    risk 0.41cvss 6.3epss 0.02

    A vulnerability classified as critical was found in Overtek OT-E801G OTE801G65.1.1.0. This vulnerability affects unknown code of the file /diag_ping.cmd?action=test&interface=ppp0.1&ipaddr=8.8.8.8%26%26cat%20/etc/passwd&ipversion=4&sessionKey=test. The manipulation leads to os…

  • CVE-2024-12358MedDec 9, 2024
    WeiYe Jing
    datax-web
    risk 0.41cvss 6.3epss 0.05

    A vulnerability was found in WeiYe-Jing datax-web 2.1.1. It has been classified as critical. This affects an unknown part of the file /api/job/add/. The manipulation of the argument glueSource leads to os command injection. It is possible to initiate the attack remotely. The…

  • CVE-2022-20871MedNov 15, 2024
    Cisco Systems, Inc.
    Asyncos
    risk 0.41cvss 6.3epss 0.02

    A vulnerability in the web management interface of Cisco AsyncOS for Cisco Secure Web Appliance, formerly Cisco Web Security Appliance (WSA), could allow an authenticated, remote attacker to perform a command injection and elevate privileges to root. This…

  • CVE-2024-11046MedNov 10, 2024
    Dlink
    DI-8003
    risk 0.41cvss 6.3epss 0.04

    A vulnerability was found in D-Link DI-8003 16.07.16A1. It has been classified as critical. Affected is the function upgrade_filter_asp of the file /upgrade_filter.asp. The manipulation of the argument path leads to os command injection. It is possible to launch the attack…

  • CVE-2024-10966MedNov 7, 2024
    Totolink
    X18
    risk 0.41cvss 6.3epss 0.03

    A vulnerability, which was classified as critical, has been found in TOTOLINK X18 9.1.0cu.2024_B20220329. Affected by this issue is some unknown functionality of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument enable leads to os command injection. The attack may…

  • CVE-2024-10919MedNov 6, 2024
    Didi
    Super Jacoco
    risk 0.41cvss 6.3epss 0.05

    A vulnerability has been found in didi Super-Jacoco 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file /cov/triggerUnitCover. The manipulation of the argument uuid leads to os command injection. The attack can be launched…

  • CVE-2024-22033MedOct 16, 2024
    SUSE S.A.
    obs-service-download_url
    risk 0.41cvss 6.3epss 0.01

    The OBS service obs-service-download_url was vulnerable to a command injection vulnerability. The attacker could provide a configuration to the service that allowed to execute command in later steps

  • CVE-2024-9001MedSep 19, 2024
    Totolink
    T10
    risk 0.41cvss 6.3epss 0.03

    A vulnerability was found in TOTOLINK T10 4.1.8cu.5207. It has been declared as critical. This vulnerability affects the function setTracerouteCfg of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument command leads to os command injection. The attack can be…

  • CVE-2024-8574MedSep 8, 2024
    Totolink
    AC1200 T8
    risk 0.41cvss 6.3epss 0.03

    A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.861_B20230220 and classified as critical. This vulnerability affects the function setParentalRules of the file /cgi-bin/cstecgi.cgi. The manipulation of the argument slaveIpList leads to os command injection. The…

  • CVE-2024-43405HigSep 4, 2024
    Projectdiscovery
    Nuclei
    risk 0.41cvss 7.4epss 0.01

    Nuclei is a vulnerability scanner powered by YAML based templates. Starting in version 3.0.0 and prior to version 3.3.2, a vulnerability in Nuclei's template signature verification system could allow an attacker to bypass the signature check and possibly execute malicious code…

  • CVE-2024-8214MedAug 27, 2024
    Dlink
    DNS-120
    risk 0.41cvss 6.3epss 0.05

    A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814.…

  • CVE-2024-8211MedAug 27, 2024
    Dlink
    DNS-120
    risk 0.41cvss 6.3epss 0.05

    A vulnerability was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814. It has been declared as…

  • CVE-2024-8127MedAug 24, 2024
    Dlink
    DNS-120
    risk 0.41cvss 6.3epss 0.07

    A vulnerability classified as critical was found in D-Link DNS-120, DNR-202L, DNS-315L, DNS-320, DNS-320L, DNS-320LW, DNS-321, DNR-322L, DNS-323, DNS-325, DNS-326, DNS-327L, DNR-326, DNS-340L, DNS-343, DNS-345, DNS-726-4, DNS-1100-4, DNS-1200-05 and DNS-1550-04 up to 20240814.…

  • CVE-2024-8077MedAug 22, 2024
    Totolink
    AC1200 T8
    risk 0.41cvss 6.3epss 0.03

    A vulnerability was found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228. It has been classified as critical. This affects the function setTracerouteCfg. The manipulation leads to os command injection. It is possible to initiate the attack remotely. NOTE: The vendor was contacted…

  • CVE-2024-8075MedAug 22, 2024
    Totolink
    AC1200 T8
    risk 0.41cvss 6.3epss 0.02

    A vulnerability has been found in TOTOLINK AC1200 T8 4.1.5cu.862_B20230228 and classified as critical. Affected by this vulnerability is the function setDiagnosisCfg. The manipulation leads to os command injection. The attack can be launched remotely. NOTE: The vendor was…