Falhas do tipo CWE-134

154 resultados

Uso de String de Formatação Controlada Externamente

Ocorre quando um programa usa entrada do usuário diretamente como argumento de formato em funções como printf(), sprintf() ou similares, sem validação. Um atacante pode injetar especificadores de formato (%x, %s, %n) para ler memória, derrubar a aplicação ou executar código arbitrário.

Exemplo

Um programa web recebe um parâmetro GET e faz printf(usuario_input) em vez de printf("%s", usuario_input). Um atacante envia ?name=%x%x%x e consegue vazar valores da pilha, ou usa %n para escrever na memória.

Como mitigar

Sempre use string de formato estática e fixa (literal), nunca construída a partir de entrada externa. Valide e sanitize qualquer dado de usuário antes de usá-lo em funções de formatação. Ferramentas como -Wformat-security do GCC ajudam a detectar isso em tempo de compilação.

CVE-2012-10055CRITICALComSndFTP v1.3.7 Beta USER Format String RCEEPSS 1.6%CVE-2021-33535HIGHWEIDMUELLER: WLAN devices affected by exploitable format string vulnerabilityEPSS 1.6%CVE-2025-64157MEDIUMA use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2EPSS 1.4%CVE-2020-15634MEDIUMThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmwEPSS 1.4%CVE-2023-39238HIGHASUS RT-AX55、RT-AX56U_V2 - Format String - 1EPSS 1.4%CVE-2022-35244CRITICALA format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X aEPSS 1.3%CVE-2022-35884HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2022-35885HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2022-35887HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2022-35886HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2025-46121CRITICALAn issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addSEPSS 1.3%CVE-2023-39240HIGHASUS RT-AX55、RT-AX56U_V2 - Format String - 3EPSS 1.3%CVE-2023-39239HIGHASUS RT-AX55、RT-AX56U_V2、RT-AC86U - Format String - 2EPSS 1.3%CVE-2024-6145HIGHActiontec WCB6200Q Cookie Format String Remote Code Execution VulnerabilityEPSS 1.2%CVE-2024-35845CRITICALwifi: iwlwifi: dbg-tlv: ensure NUL terminationEPSS 1.2%CVE-2019-6840—A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server PluEPSS 1.1%CVE-2025-46123HIGHAn issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.EPSS 1.1%CVE-2023-35087CRITICALASUS RT-AX56U V2 & RT-AC86U - Format String - 2EPSS 1.1%CVE-2023-36639HIGHA use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4EPSS 1.1%CVE-2020-1979HIGHPAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalationEPSS 1.0%