Fallos del tipo CWE-77
2807 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2025-45487MEDIUMLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.InternetConnection function.EPSS 11.0%CVE-2025-14884HIGHD-Link DIR-605 Firmware Update Service command injectionEPSS 11.0%CVE-2025-45988CRITICALBlink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450EPSS 10.9%CVE-2025-66399HIGHSNMP Command Injection leads to RCE in CactiEPSS 10.8%CVE-2026-9515MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injectionEPSS 10.8%CVE-2026-9532MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUploadUserData os command injectionEPSS 10.8%CVE-2026-9514MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setNetworkDiag os command injectionEPSS 10.8%CVE-2026-9534MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setWiFiWpsConfig os command injectionEPSS 10.8%CVE-2026-9533MEDIUMTotolink CA750-PoE Setting cstecgi.cgi recvUpgradeNewFw os command injectionEPSS 10.8%CVE-2026-9531MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injectionEPSS 10.8%CVE-2025-15136HIGHTRENDnet TEW-800MB Management wizardset do_setWizard_asp command injectionEPSS 10.7%CVE-2025-47959HIGHVisual Studio Remote Code Execution VulnerabilityEPSS 10.7%CVE-2024-48288HIGHTP-Link TL-IPC42C V4.0_20211227_1.0.16 is vulnerable to command injection due to the lack of malicious code verification on both the frontenEPSS 10.6%CVE-2022-40765MEDIUMA vulnerability in the Edge Gateway component of Mitel MiVoice Connect through 19.3 (22.22.6100.0) could allow an authenticated attacker witEPSS 10.6%KEVCVE-2025-7407MEDIUMNetgear D6400 diag.cgi os command injectionEPSS 10.6%CVE-2024-46048HIGHTenda FH451 v1.0.0.9 has a command injection vulnerability in the formexeCommand function iEPSS 10.5%CVE-2026-4840HIGHNetcore Power 15AX Diagnostic Tool netis.cgi setTools os command injectionEPSS 10.5%CVE-2025-14108HIGHZSPACE Q2C NAS HTTP POST Request open zfilev2_api.OpenSafe command injectionEPSS 10.5%CVE-2026-20147CRITICALCisco Identity Services Engine Remote Code Execution VulnerabilityEPSS 10.4%CVE-2026-2184MEDIUMGreat Developers Certificate Generation System csv.php os command injectionEPSS 10.3%