Falhas do tipo CWE-77

2.810 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2026-7721MEDIUMTotolink WA300 cstecgi.cgi NTPSyncWithHost command injectionEPSS 1.8%CVE-2026-15546MEDIUMShibby Tomato start_jffs2 sub_2D568 os command injectionEPSS 1.8%CVE-2026-15486MEDIUMTRENDnet TEW-821DAP Firmware Update tools_ddns sub_42026C os command injectionEPSS 1.8%CVE-2026-7720MEDIUMTotolink WA300 POST Request cstecgi.cgi setLanguageCfg command injectionEPSS 1.8%CVE-2026-9565MEDIUMhaojing8312 WorkClaw Blacklist bash.rs is_dangerous os command injectionEPSS 1.8%CVE-2026-19982MEDIUMGL.iNet BE9300/MT6000 Firewall-management RPC os command injectionEPSS 1.8%CVE-2026-77945MEDIUMTRENDnet TEW-821DAP ssi upload.cgi command injectionEPSS 1.8%CVE-2026-15487MEDIUMTRENDnet TEW-821DAP Firmware Update system_ntp sub_41FBD0 os command injectionEPSS 1.8%CVE-2026-15485MEDIUMTRENDnet TEW-821DAP DNS Lookup tools_nslookup sub_43F2C4 os command injectionEPSS 1.8%CVE-2026-9531MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUpgradeUboot os command injectionEPSS 1.8%CVE-2026-7718MEDIUMTotolink WA300 POST Request cstecgi.cgi setWebWlanIdx command injectionEPSS 1.8%CVE-2026-9515MEDIUMTotolink CA750-PoE Setting cstecgi.cgi setUnloadUserData os command injectionEPSS 1.8%CVE-2026-6108MEDIUM1Panel-dev MaxKB Model Context Protocol Node base_mcp_node.py execute os command injectionEPSS 1.8%CVE-2026-38702CRITICALA command injection vulnerability exists in the Admin Access feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IREPSS 1.8%CVE-2026-36841CRITICALTOTOLINK N200RE V5 was discovered to contain a command injection vulnerability via the macstr and bandstr parameters in the formMapDelDeviceEPSS 1.8%CVE-2026-38703CRITICALA command injection vulnerability exists in the ZeroTier VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IREPSS 1.8%CVE-2026-38707CRITICALA command injection vulnerability exists in the IPSec VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IR315EPSS 1.8%CVE-2026-38704CRITICALA command injection vulnerability exists in the WireGuard VPN feature of InHand Networks IR302 firmware V3.5.108, IR305 firmware V1.0.118, IEPSS 1.8%CVE-2023-36805HIGHWindows MSHTML Platform Security Feature Bypass VulnerabilityEPSS 1.8%CVE-2024-30637HIGHTenda F1202 v1.2.0.20(408) has a command injection vulnerablility in the formWriteFacMac function in the mac parameter.EPSS 1.8%