Fallos del tipo CWE-77
2808 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2022-32765CRITICALAn OS command injection vulnerability exists in the sysupgrade command injection functionality of Robustel R1510 3.1.16 and 3.3.0. A specialEPSS 3.5%CVE-2025-11490MEDIUMwonderwhy-er DesktopCommanderMCP Absolute Path command-manager.ts extractBaseCommand os command injectionEPSS 3.5%CVE-2026-1326MEDIUMTotolink NR1800X POST Request cstecgi.cgi setWanCfg command injectionEPSS 3.5%CVE-2026-1802MEDIUMZiroom ZHOME A0101 zrMacClone.lua macAddrClone command injectionEPSS 3.5%CVE-2024-23626CRITICALMotorola MR2600 SaveSysLogParams Command Injection VulnerabilityEPSS 3.5%CVE-2024-23627CRITICALMotorola MR2600 SaveStaticRouteIPv4Params Command Injection VulnerabilityEPSS 3.5%CVE-2020-3211HIGHCisco IOS XE Software Web UI Command Injection VulnerabilityEPSS 3.5%CVE-2025-60673MEDIUMAn unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in EPSS 3.5%CVE-2026-4499MEDIUMD-Link DIR-820LW SSDP ssdpcgi_main os command injectionEPSS 3.5%CVE-2019-16005HIGHCisco Webex Video Mesh Node Command Injection VulnerabilityEPSS 3.5%CVE-2016-6558—The ASUS RP-AC52 access point, firmware version 1.0.1.1s and possibly earlier, is vulnerable to command injectionEPSS 3.5%CVE-2025-60676MEDIUMAn unauthenticated command injection vulnerability exists in the D-Link DIR-878A1 router firmware FW101B04.bin. The vulnerability occurs in EPSS 3.5%CVE-2026-1544MEDIUMD-Link DIR-823X set_mode sub_41E2A0 os command injectionEPSS 3.5%CVE-2023-30400CRITICALAn issue was discovered in Anyka Microelectronics AK3918EV300 MCU v18. A command injection vulnerability in the network configuration scriptEPSS 3.5%CVE-2026-2193MEDIUMD-Link DI-7100G C1 set_jhttpd_info command injectionEPSS 3.5%CVE-2026-4468MEDIUMComfast CF-AC100 mbox-config command injectionEPSS 3.4%CVE-2026-4591MEDIUMkalcaddle kodbox fileThumb Endpoint app.php checkBin os command injectionEPSS 3.4%CVE-2023-22371HIGHAn os command injection vulnerability exists in the liburvpn.so create_private_key functionality of Milesight VPN v2.0.2. A specially-crafteEPSS 3.4%CVE-2026-6987MEDIUMPicoClaw Web Launcher Management Plane restart command injectionEPSS 3.4%CVE-2025-5606MEDIUMTenda AC18 SetIPTVCfg formSetIptv command injectionEPSS 3.4%