CWE-77— Command Injection

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.— MITRE CWE catalog

4,588 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-77page 18 of 92

CVE-2022-48259CRITICALCVSS 9.8EG 9.8
2023-02-27
There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. Successful exploitation could allow attackers to gain higher privileges.
CVE-2022-48255CRITICALCVSS 9.8EG 9.8
2023-02-27
There is a system command injection vulnerability in BiSheng-WNM FW 3.0.0.325. A Huawei printer has a system command injection vulnerability. Successful exploitation could lead to remote code execution.
CVE-2023-23080CRITICALCVSS 9.8EG 9.8
2023-02-27
Certain Tenda products are vulnerable to command injection. This affects Tenda CP7 Tenda CP7<=V11.10.00.2211041403 and Tenda CP3 v.10 Tenda CP3 v.10<=V20220906024_2025 and Tenda IT7-PCS Tenda IT7-PCS<=V2209020914 and Tenda IT7-LCS Tenda IT…
CVE-2023-26602CRITICALCVSS 9.8EG 9.8
2023-02-26
ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create extensions, as demonstrated by snmpset for NET-SNMP-EXTEND-MIB with /bin/sh for command execution.
CVE-2023-24184CRITICALCVSS 9.8EG 9.8
2023-02-21
TOTOLink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability.
CVE-2022-48337CRITICALCVSS 9.8EG 9.8
2023-02-20
GNU Emacs through 28.2 allows attackers to execute commands via shell metacharacters in the name of a source-code file, because lib-src/etags.c uses the system C library function in its implementation of the etags program. For example, a v…
CVE-2023-25805CRITICALCVSS 9.8EG 9.8
2023-02-20
versionn, software for changing version information across multiple files, has a command injection vulnerability in all versions prior to version 1.1.0. This issue is patched in version 1.1.0.
CVE-2022-40021CRITICALCVSS 9.8EG 9.8
2023-02-17
QVidium Technologies Amino A140 (prior to firmware version 1.0.0-283) was discovered to contain a command injection vulnerability.
CVE-2023-24238CRITICALCVSS 9.8EG 9.8
2023-02-16
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the city parameter at setting/delStaticDhcpRules.
CVE-2023-24236CRITICALCVSS 9.8EG 9.8
2023-02-16
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the province parameter at setting/delStaticDhcpRules.
CVE-2023-24161CRITICALCVSS 9.8EG 9.8
2023-02-14
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the webWlanIdx parameter in the setWebWlanIdx function.
CVE-2023-24160CRITICALCVSS 9.8EG 9.8
2023-02-14
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admuser parameter in the setPasswordCfg function.
CVE-2023-24159CRITICALCVSS 9.8EG 9.8
2023-02-14
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the admpass parameter in the setPasswordCfg function.
CVE-2022-40022CRITICALCVSS 9.8EG 9.8
2023-02-13
Microchip Technology (Microsemi) SyncServer S650 was discovered to contain a command injection vulnerability.
CVE-2022-45699CRITICALCVSS 9.8EG 9.8
2023-02-10
Command injection in the administration interface in APSystems ECU-R version 5203 allows a remote unauthenticated attacker to execute arbitrary commands as root using the timezone parameter.
CVE-2022-43550CRITICALCVSS 9.8EG 9.8
2023-02-09
A command injection vulnerability exists in Jitsi before commit 8aa7be58522f4264078d54752aae5483bfd854b2 when launching browsers on Windows which could allow an attacker to insert an arbitrary URL which opens up the opportunity to remote e…
CVE-2023-23333CRITICALCVSS 9.8EG 9.8
2023-02-06
There is a command injection vulnerability in SolarView Compact through 6.00, attackers can execute commands by bypassing internal restrictions through downloader.php.
CVE-2021-31575CRITICALCVSS 9.8EG 9.8
2023-02-06
In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not n…
CVE-2021-31574CRITICALCVSS 9.8EG 9.8
2023-02-06
In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not n…
CVE-2021-31573CRITICALCVSS 9.8EG 9.8
2023-02-06
In Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege from a proximal attacker with no additional execution privileges needed. User interaction is not n…
CVE-2023-24276CRITICALCVSS 9.8EG 9.8
2023-02-06
TOTOlink A7100RU(V7.4cu.2313_B20191024) was discovered to contain a command injection vulnerability via the country parameter at setting/delStaticDhcpRules.
CVE-2023-24157CRITICALCVSS 9.8EG 9.8
2023-02-03
A command injection vulnerability in the serverIp parameter in the function updateWifiInfo of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24156CRITICALCVSS 9.8EG 9.8
2023-02-03
A command injection vulnerability in the ip parameter in the function recvSlaveUpgstatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24154CRITICALCVSS 9.8EG 9.8
2023-02-03
TOTOLINK T8 V4.1.5cu was discovered to contain a command injection vulnerability via the slaveIpList parameter in the function setUpgradeFW.
CVE-2023-24153CRITICALCVSS 9.8EG 9.8
2023-02-03
A command injection vulnerability in the version parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24152CRITICALCVSS 9.8EG 9.8
2023-02-03
A command injection vulnerability in the serverIp parameter in the function meshSlaveUpdate of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24151CRITICALCVSS 9.8EG 9.8
2023-02-03
A command injection vulnerability in the ip parameter in the function recvSlaveCloudCheckStatus of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24150CRITICALCVSS 9.8EG 9.8
2023-02-03
A command injection vulnerability in the serverIp parameter in the function meshSlaveDlfw of TOTOLINK T8 V4.1.5cu allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2023-24148CRITICALCVSS 9.8EG 9.8
2023-02-03
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the FileName parameter in the setUploadUserData function.
CVE-2023-24146CRITICALCVSS 9.8EG 9.8
2023-02-03
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the minute parameter in the setRebootScheCfg function.
CVE-2023-24145CRITICALCVSS 9.8EG 9.8
2023-02-03
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the plugin_version parameter in the setUnloadUserData function.
CVE-2023-24144CRITICALCVSS 9.8EG 9.8
2023-02-03
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the hour parameter in the setRebootScheCfg function.
CVE-2023-24143CRITICALCVSS 9.8EG 9.8
2023-02-03
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagTracertHop parameter in the setNetworkDiag function.
CVE-2023-24142CRITICALCVSS 9.8EG 9.8
2023-02-03
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingSize parameter in the setNetworkDiag function.
CVE-2023-24141CRITICALCVSS 9.8EG 9.8
2023-02-03
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingTimeOut parameter in the setNetworkDiag function.
CVE-2023-24140CRITICALCVSS 9.8EG 9.8
2023-02-03
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagPingNum parameter in the setNetworkDiag function.
CVE-2023-24139CRITICALCVSS 9.8EG 9.8
2023-02-03
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the NetDiagHost parameter in the setNetworkDiag function.
CVE-2023-24138CRITICALCVSS 9.8EG 9.8
2023-02-03
TOTOLINK CA300-PoE V6.2c.884 was discovered to contain a command injection vulnerability via the host_time parameter in the NTPSyncWithHost function.
CVE-2022-48175CRITICALCVSS 9.8EG 9.8
2023-01-30
Rukovoditel v3.2.1 was discovered to contain a remote code execution (RCE) vulnerability in the component /rukovoditel/index.php?module=dashboard/ajax_request.
CVE-2023-24612CRITICALCVSS 9.8EG 9.8
2023-01-30
The PdfBook extension through 2.0.5 before b07b6a64 for MediaWiki allows command injection via an option.
CVE-2022-48108CRITICALCVSS 9.8EG 9.8
2023-01-27
D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
CVE-2022-48107CRITICALCVSS 9.8EG 9.8
2023-01-27
D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
CVE-2023-22884CRITICALCVSS 9.8EG 9.8
2023-01-21
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow, Apache Software Foundation Apache Airflow MySQL Provider.This issue affects Apache Airflow: bef…
CVE-2022-48126CRITICALCVSS 9.8EG 9.8
2023-01-20
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the username parameter in the setting/setOpenVpnCertGenerationCfg function.
CVE-2022-48125CRITICALCVSS 9.8EG 9.8
2023-01-20
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the password parameter in the setting/setOpenVpnCertGenerationCfg function.
CVE-2022-48124CRITICALCVSS 9.8EG 9.8
2023-01-20
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the FileName parameter in the setting/setOpenVpnCertGenerationCfg function.
CVE-2022-48123CRITICALCVSS 9.8EG 9.8
2023-01-20
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the servername parameter in the setting/delStaticDhcpRules function.
CVE-2022-48122CRITICALCVSS 9.8EG 9.8
2023-01-20
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the dayvalid parameter in the setting/delStaticDhcpRules function.
CVE-2022-48121CRITICALCVSS 9.8EG 9.8
2023-01-20
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the rsabits parameter in the setting/delStaticDhcpRules function.
CVE-2022-46476CRITICALCVSS 9.8EG 9.8
2023-01-19
D-Link DIR-859 A1 1.05 was discovered to contain a command injection vulnerability via the service= variable in the soapcgi_main function.

Map vulnerabilities like CWE-77 to your infrastructure

EchelonGraph correlates every CVE — across CWE-77 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →