Falhas do tipo CWE-77

2.810 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2025-25743HIGHD-Link DIR-853 A1 FW1.20B07 was discovered to contain a command injection vulnerability in the SetVirtualServerSettings module.EPSS 1.7%CVE-2020-2492HIGHIf exploited, the command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP SysteEPSS 1.7%CVE-2025-55637MEDIUMReolink Smart 2K+ Plug-in Wi-Fi Video Doorbell with Chime - firmware v3.0.0.4662_2503122283 was discovered to contain a command injection vuEPSS 1.7%CVE-2025-5952MEDIUMZend.To NSSDropoff.php exec os command injectionEPSS 1.7%CVE-2024-3871CRITICALAuthenticated Remote Command Injection in Delta Electronics DVWEPSS 1.7%CVE-2023-26295CRITICALPrevious versions of HP Device Manager (prior to HPDM 5.0.10) could potentially allow command injection and/or elevation of privileges.EPSS 1.7%CVE-2026-94099CRITICALNetcore NBR200V2 Backup Restore restore.cgi command injectionEPSS 1.7%CVE-2022-20799MEDIUMCisco Small Business RV Series Routers Command Injection VulnerabilitiesEPSS 1.7%CVE-2025-7883HIGHEluktronics Control Center Powershell Script Command command injectionEPSS 1.7%CVE-2026-11452MEDIUMGL.iNet GL-MT3000 SET_USER_PWD glc FUN_0042e200 command injectionEPSS 1.7%CVE-2023-33136HIGHAzure DevOps Server Remote Code Execution VulnerabilityEPSS 1.7%CVE-2021-31574CRITICALIn Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilegeEPSS 1.7%CVE-2026-53932HIGHwnx/laravel-backup-restore: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') and Improper Neutralization of Special Elements used in a Command ('Command Injection')EPSS 1.7%CVE-2021-31573CRITICALIn Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilegeEPSS 1.7%CVE-2025-57293HIGHA command injection vulnerability in COMFAST CF-XR11 (firmware V2.7.2) exists in the multi_pppoe API, processed by the sub_423930 function iEPSS 1.7%CVE-2024-48440HIGHShenzhen Tuoshi Network Communications Co.,Ltd 5G CPE Router NR500-EA RG500UEAABxCOMSLICv3.2.2543.12.18 was discovered to contain a command EPSS 1.7%CVE-2021-31575CRITICALIn Config Manager, there is a possible command injection due to improper input validation. This could lead to remote escalation of privilegeEPSS 1.7%CVE-2025-25632CRITICALTenda AC15 v15.03.05.19 is vulnerable to Command Injection via the handler function in /goform/telnet.EPSS 1.7%CVE-2024-57224CRITICALLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_do_enr_pin_wps fuEPSS 1.7%CVE-2024-57225CRITICALLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the devname parameter in the reset_wifi function.EPSS 1.7%