Falhas do tipo CWE-77

2.965 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2024-8129MEDIUMD-Link DNS-1550-04 HTTP POST Request s3.cgi cgi_s3_modify command injectionEPSS 23.8%CVE-2024-5195MEDIUMArris VAP2500 diag_s.php command injectionEPSS 23.6%CVE-2024-5196MEDIUMArris VAP2500 tools_command.php command injectionEPSS 23.6%CVE-2024-37186CRITICALAn os command injection vulnerability exists in the adm.cgi set_ledonoff() functionality of Wavlink AC3000 M33A8.V5030.210505. A specially cEPSS 23.4%CVE-2024-39914CRITICAL FOG has a command injection in /fog/management/export.php?filename=EPSS 23.2%CVE-2024-9793MEDIUMTenda AC1206 ate ate_ifconfig_set command injectionEPSS 23.1%CVE-2025-7769HIGHImproper Neutralization of Special Elements used in a Command ('Command Injection') in Tigo Energy Cloud Connect AdvancedEPSS 23.0%CVE-2021-22899HIGHA command injection vulnerability exists in Pulse Connect Secure before 9.1R11.4 allows a remote authenticated attacker to perform remote coEPSS 22.9%KEVCVE-2024-53945HIGHThe KuWFi 4G AC900 LTE router 1.0.13 is vulnerable to command injection on the HTTP API endpoints /goform/formMultiApnSetting and /goform/atEPSS 22.9%CVE-2023-44959HIGHAn issue found in D-Link DSL-3782 v.1.03 and before allows remote authenticated users to execute arbitrary code as root via the Router IP AdEPSS 22.8%CVE-2025-44084CRITICALD-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests,EPSS 22.6%CVE-2016-6367HIGHCisco Adaptive Security Appliance (ASA) Software before 8.4(1) on ASA 5500, ASA 5500-X, PIX, and FWSM devices allows local users to gain priEPSS 22.6%KEVCVE-2024-0919HIGHTRENDnet TEW-815DAP POST Request do_setNTP command injectionEPSS 22.5%CVE-2025-27423HIGHImproper Input Validation in VimEPSS 22.5%CVE-2025-15472HIGHTRENDnet TEW-811DRU httpd  uapply.cgi setDeviceURL  os command injectionEPSS 22.4%CVE-2023-45498CRITICALVinChin Backup & Recovery v5.0.*, v6.0.*, v6.7.*, and v7.0.* was discovered to contain a command injection vulnerability.EPSS 22.0%CVE-2026-3064MEDIUMHummerRisk Cloud Task Scheduler ResourceCreateService.java command injectionEPSS 21.9%CVE-2024-53333MEDIUMTOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allEPSS 21.2%CVE-2023-0830MEDIUMEasyNAS backup.pl system os command injectionEPSS 20.9%CVE-2024-9076MEDIUMDedeCMS article_string_mix.php os command injectionEPSS 20.8%