CWE-77— Command Injection

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.— MITRE CWE catalog

4,588 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-77page 19 of 92

CVE-2022-47853CRITICALCVSS 9.8EG 9.8
2023-01-17
TOTOlink A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection Vulnerability in the httpd service. An attacker can obtain a stable root shell through a specially constructed payload.
CVE-2022-39073CRITICALCVSS 9.8EG 9.8
2023-01-06
There is a command injection vulnerability in ZTE MF286R, Due to insufficient validation of the input parameters, an attacker could use the vulnerability to execute arbitrary commands.
CVE-2023-22671CRITICALCVSS 9.8EG 9.8
2023-01-06
Ghidra/RuntimeScripts/Linux/support/launch.sh in NSA Ghidra through 10.2.2 passes user-provided input into eval, leading to command injection when calling analyzeHeadless with untrusted input.
CVE-2022-32665CRITICALCVSS 9.8EG 9.8
2023-01-03
In Boa, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilege with no additional execution privileges needed. User interaction is not needed for exploitation. Patch ID: A2…
CVE-2022-44621CRITICALCVSS 9.8EG 9.8
2022-12-30
Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
CVE-2022-45717CRITICALCVSS 9.8EG 9.8
2022-12-23
IP-COM M50 V15.11.0.33(10768) was discovered to contain a command injection vulnerability via the usbPartitionName parameter in the formSetUSBPartitionUmount function. This vulnerability is exploited via a crafted GET request.
CVE-2022-46538CRITICALCVSS 9.8EG 9.8
2022-12-20
Tenda F1203 V2.0.1.6 was discovered to contain a command injection vulnerability via the mac parameter at /goform/WriteFacMac.
CVE-2022-46421CRITICALCVSS 9.8EG 9.8
2022-12-20
Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in Apache Software Foundation Apache Airflow Hive Provider.This issue affects Apache Airflow Hive Provider: before 5.0.0.
CVE-2022-46634CRITICALCVSS 9.8EG 9.8
2022-12-15
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiWpsCfg function.
CVE-2022-46631CRITICALCVSS 9.8EG 9.8
2022-12-15
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the wscDisabled parameter in the setting/setWiFiSignalCfg function.
CVE-2022-31702CRITICALCVSS 9.8EG 9.8
2022-12-14
vRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network access to the vRNI REST API can execute commands without authentication.
CVE-2022-44832CRITICALCVSS 9.8EG 9.8
2022-12-14
D-Link DIR-3040 device with firmware 120B03 was discovered to contain a command injection vulnerability via the SetTriggerLEDBlink function.
CVE-2022-46404CRITICALCVSS 9.8EG 9.8
2022-12-13
A command injection vulnerability has been identified in Atos Unify OpenScape 4000 Assistant and Unify OpenScape 4000 Manager (8 before R2.22.18, 10 before 0.28.13, and 10 R1 before R1.34.4) that may allow an unauthenticated attacker to up…
CVE-2022-45005CRITICALCVSS 9.8EG 9.8
2022-12-13
IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the cmd_get_ping_output function.
CVE-2022-37897CRITICALCVSS 9.8EG 9.8
2022-12-12
There is a command injection vulnerability that could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba Networks AP management protocol) UDP port (8211). Successful exploitation …
CVE-2022-45506CRITICALCVSS 9.8EG 9.8
2022-12-08
Tenda W30E v1.0.1.25(633) was discovered to contain a command injection vulnerability via the fileNameMit parameter at /goform/delFileName.
CVE-2022-45497CRITICALCVSS 9.8EG 9.8
2022-12-08
Tenda W6-S v1.0.0.4(510) was discovered to contain a command injection vulnerability in the tpi_get_ping_output function at /goform/exeCommand.
CVE-2022-45025CRITICALCVSS 9.8EG 9.8
2022-12-07
Markdown Preview Enhanced v0.6.5 and v0.19.6 for VSCode and Atom was discovered to contain a command injection vulnerability via the PDF file import function.
CVE-2022-44930CRITICALCVSS 9.8EG 9.8
2022-12-02
D-Link DHP-W310AV 3.10EU was discovered to contain a command injection vulnerability via the System Checks function.
CVE-2022-44928CRITICALCVSS 9.8EG 9.8
2022-12-02
D-Link DVG-G5402SP GE_1.03 was discovered to contain a command injection vulnerability via the Maintenance function.
CVE-2022-45907CRITICALCVSS 9.8EG 9.8
2022-11-26
In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line can cause arbitrary code execution because eval is used unsafely.
CVE-2022-44844CRITICALCVSS 9.8EG 9.8
2022-11-25
TOTOlink A7100RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the pass parameter in the setting/setOpenVpnCfg function.
CVE-2022-44252CRITICALCVSS 9.8EG 9.8
2022-11-23
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the setUploadSetting function.
CVE-2022-44251CRITICALCVSS 9.8EG 9.8
2022-11-23
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the ussd parameter in the setUssd function.
CVE-2022-44250CRITICALCVSS 9.8EG 9.8
2022-11-23
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the hostName parameter in the setOpModeCfg function.
CVE-2022-44249CRITICALCVSS 9.8EG 9.8
2022-11-23
TOTOLINK NR1800X V9.1.0u.6279_B20210910 contains a command injection via the FileName parameter in the UploadFirmwareFile function.
CVE-2022-45462CRITICALCVSS 9.8EG 9.8
2022-11-23
Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher
CVE-2020-23584CRITICALCVSS 9.8EG 9.8
2022-11-23
Unauthenticated remote code execution in OPTILINK OP-XT71000N, Hardware Version: V2.2 occurs when the attacker passes arbitrary commands with IP-ADDRESS using " | " to execute commands on " /diag_tracert_admin.asp " in the "PingTest" param…
CVE-2020-23583CRITICALCVSS 9.8EG 9.8
2022-11-23
OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully tr…
CVE-2022-40881CRITICALCVSS 9.8EG 9.8
2022-11-17
SolarView Compact 6.00 was discovered to contain a command injection vulnerability via network_test.php
CVE-2022-43781CRITICALCVSS 9.8EG 9.8
2022-11-17
There is a command injection vulnerability using environment variables in Bitbucket Server and Data Center. An attacker with permission to control their username can exploit this issue to execute arbitrary code on the system. This vulnerab…
CVE-2022-40752CRITICALCVSS 9.8EG 9.8
2022-11-16
IBM InfoSphere DataStage 11.7 is vulnerable to a command injection vulnerability due to improper neutralization of special elements. IBM X-Force ID: 236687.
CVE-2022-45063CRITICALCVSS 9.8EG 9.8
2022-11-10
xterm before 375 allows code execution via font ops, e.g., because an OSC 50 response may have Ctrl-g and therefore lead to command execution within the vi line-editing mode of Zsh. NOTE: font ops are not allowed in the xterm default confi…
CVE-2022-43109CRITICALCVSS 9.8EG 9.8
2022-11-03
D-Link DIR-823G v1.0.2 was found to contain a command injection vulnerability in the function SetNetworkTomographySettings. This vulnerability allows attackers to execute arbitrary commands via a crafted packet.
CVE-2022-43367CRITICALCVSS 9.8EG 9.8
2022-10-27
IP-COM EW9 V15.11.0.14(9732) was discovered to contain a command injection vulnerability in the formSetDebugCfg function.
CVE-2022-32765CRITICALCVSS 9.8EG 9.8
2022-10-25
An OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. A specially-crafted network request can lead to arbitrary command execution. An attacker can send a sequence…
CVE-2022-43184CRITICALCVSS 9.8EG 9.8
2022-10-19
D-Link DIR878 1.30B08 Hotfix_04 was discovered to contain a command injection vulnerability via the component /bin/proc.cgi.
CVE-2022-24697CRITICALCVSS 9.8EG 9.8
2022-10-13
Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- …
CVE-2022-42897CRITICALCVSS 9.8EG 9.8
2022-10-13
Array Networks AG/vxAG with ArrayOS AG before 9.4.0.469 allows unauthenticated command injection that leads to privilege escalation and control of the system. NOTE: ArrayOS AG 10.x is unaffected.
CVE-2022-41518CRITICALCVSS 9.8EG 9.8
2022-10-06
TOTOLINK NR1800X V9.1.0u.6279_B20210910 was discovered to contain a command injection vulnerability via the UploadFirmwareFile function at /cgi-bin/cstecgi.cgi.
CVE-2022-40475CRITICALCVSS 9.8EG 9.8
2022-09-29
TOTOLINK A860R V4.1.2cu.5182_B20201027 was discovered to contain a command injection via the component /cgi-bin/downloadFile.cgi.
CVE-2022-40100CRITICALCVSS 9.8EG 9.8
2022-09-23
Tenda i9 v1.0.0.8(3828) was discovered to contain a command injection vulnerability via the FormexeCommand function.
CVE-2022-38828CRITICALCVSS 9.8EG 9.8
2022-09-16
TOTOLINK T6 V4.1.5cu.709_B20210518 is vulnerable to command injection via cstecgi.cgi
CVE-2022-38826CRITICALCVSS 9.8EG 9.8
2022-09-16
In TOTOLINK T6 V4.1.5cu.709_B20210518, there is an execute arbitrary command in cstecgi.cgi.
CVE-2022-38308CRITICALCVSS 9.8EG 9.8
2022-09-14
TOTOLink A700RU V7.4cu.2313_B20191024 was discovered to contain a command injection vulnerability via the lang parameter in the function cstesystem. This vulnerability allows attackers to execute arbitrary commands via a crafted payload.
CVE-2022-37860CRITICALCVSS 9.8EG 9.8
2022-09-12
The web configuration interface of the TP-Link M7350 V3 with firmware version 190531 is affected by a pre-authentication command injection vulnerability.
CVE-2022-33941CRITICALCVSS 9.8EG 9.8
2022-09-08
PowerCMS XMLRPC API provided by Alfasado Inc. contains a command injection vulnerability. Sending a specially crafted message by POST method to PowerCMS XMLRPC API may allow arbitrary Perl script execution, and an arbitrary OS command may …
CVE-2022-37843CRITICALCVSS 9.8EG 9.8
2022-09-06
In TOTOLINK A860R V4.1.2cu.5182_B20201027 in cstecgi.cgi, the acquired parameters are directly put into the system for execution without filtering, resulting in a command injection vulnerability.
CVE-2022-37130CRITICALCVSS 9.8EG 9.8
2022-08-31
In D-Link DIR-816 A2_v1.10CNB04, DIR-878 DIR_878_FW1.30B08.img a command injection vulnerability occurs in /goform/Diagnosis, after the condition is met, setnum will be spliced into v10 by snprintf, and the system will be executed, resulti…
CVE-2022-37125CRITICALCVSS 9.8EG 9.8
2022-08-31
D-link DIR-816 A2_v1.10CNB04.img is vulnerable to Command injection via /goform/NTPSyncWithHost.

Map vulnerabilities like CWE-77 to your infrastructure

EchelonGraph correlates every CVE — across CWE-77 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Book a Demo →