Fallos del tipo CWE-77
2810 resultadosInjeção de comando via entrada não sanitizada
O software constrói comandos (shell, SQL, LDAP, etc.) usando dados de entrada do usuário sem neutralizar caracteres especiais que alteram a semântica do comando. Um atacante injeta metacaracteres (como `;`, `|`, `$()`) para executar instruções não previstas.
Ejemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validação. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos, porque o ponto-e-vírgula encadeia comandos no shell.
Cómo mitigar
Use APIs de execução que separam dados de comando (ex: `execvp()` com array de argumentos em vez de shell, prepared statements para SQL). Se shell for inevitável, whitelist rigoroso de entrada e escape apropriado com `escapeshellarg()` ou equivalente na linguagem.
CVE-2023-29802CRITICALTOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfgEPSS 2.0%CVE-2023-29801CRITICALTOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServEPSS 2.0%CVE-2023-29800CRITICALTOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirEPSS 2.0%CVE-2022-20801MEDIUMCisco Small Business RV Series Routers Command Injection VulnerabilitiesEPSS 2.0%CVE-2024-50591HIGHLocal Privilege Escalation via Command InjectionEPSS 2.0%CVE-2026-94096CRITICALNetcore NBR200V2 LAN IP Configuration network_tools command injectionEPSS 2.0%CVE-2022-28220—STARTTLS command injection in Apache JAMESEPSS 2.0%CVE-2025-11045MEDIUMWAYOS LQ_04/LQ_05/LQ_06/LQ_07/LQ_09 usb_paswd.asp command injectionEPSS 2.0%CVE-2026-9296MEDIUMEdimax BR-6428NS POST Request formWlanM system command injectionEPSS 2.0%CVE-2026-9359MEDIUMEdimax EW-7438RPn POST Request formHwSet command injectionEPSS 2.0%CVE-2026-9437MEDIUMDTStack Taier REST API Runtime.exec os command injectionEPSS 2.0%CVE-2026-13581MEDIUMEdimax EW-7478APC POST Request formStaDrvSetup os command injectionEPSS 2.0%CVE-2026-13560MEDIUMEdimax EW-7478APC POST Request formAccept os command injectionEPSS 2.0%CVE-2026-12808MEDIUMEdimax BR-6478AC V2 POST Request stainfo command injectionEPSS 2.0%CVE-2026-9424MEDIUMEdimax EW-7438RPn Content-Type formWlanMP os command injectionEPSS 2.0%CVE-2026-9362MEDIUMEdimax EW-7438RPn Setting formConnectionSetting command injectionEPSS 2.0%CVE-2026-19960MEDIUMEdimax EW-7478APC formWlbasic command injectionEPSS 2.0%CVE-2026-9361MEDIUMEdimax EW-7438RPn POST Request formAccep formAccept command injectionEPSS 2.0%CVE-2026-9297MEDIUMEdimax BR-6428NS POST Request formWlbasic command injectionEPSS 2.0%CVE-2026-9439MEDIUMEdimax BR-6675nD stainfo command injectionEPSS 2.0%