Falhas do tipo CWE-77

2.810 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2024-57223CRITICALLinksys E7350 1.1.00.032 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_wps_gen_pincode fEPSS 1.7%CVE-2023-6572CRITICALCommand Injection in gradio-app/gradioEPSS 1.7%CVE-2025-45490MEDIUMLinksys E5600 v1.1.0.26 was discovered to contain a command injection vulnerability in the runtime.ddnsStatus DynDNS function via the passwoEPSS 1.7%CVE-2024-48441HIGHWuhan Tianyu Information Industry Co., Ltd Tianyu CPE Router CommonCPExCPETS_v3.2.468.11.04_P4 was discovered to contain a command injectionEPSS 1.7%CVE-2023-52027CRITICALTOTOlink A3700R v9.1.2u.5822_B20200513 was discovered to contain a remote command execution (RCE) vulnerability via the NTPSyncWithHost funcEPSS 1.7%CVE-2026-95660MEDIUMMoonshot AI Kimi Code MCP Configuration Loader config-loader.ts os command injectionEPSS 1.7%CVE-2023-0789HIGHCommand Injection in thorsten/phpmyfaqEPSS 1.7%CVE-2021-1552MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-1549MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-1553MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-1550MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-1551MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-1555MEDIUMCisco Small Business 100, 300, and 500 Series Wireless Access Points Command Injection VulnerabilitiesEPSS 1.7%CVE-2021-44051HIGHCommand injectionEPSS 1.7%CVE-2022-31702CRITICALvRealize Network Insight (vRNI) contains a command injection vulnerability present in the vRNI REST API. A malicious actor with network acceEPSS 1.7%CVE-2023-39293CRITICALA Command Injection vulnerability has been identified in the MiVoice Office 400 SMB Controller through 1.2.5.23 which could allow a maliciouEPSS 1.7%CVE-2023-31460HIGHA vulnerability in the Connect Mobility Router component of MiVoice Connect versions 9.6.2208.101 and earlier could allow an authenticated aEPSS 1.7%CVE-2025-29517MEDIUMD-Link DSL-7740C with firmware DSL7740C.V6.TR069.20211230 was discovered to contain a command injection vulnerability via the traceroute6 fuEPSS 1.6%CVE-2025-45984CRITICALBlink routers BL-WR9000 V2.4.9, BL-AC1900 V1.0.2, BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 V1.0.5, BL-LTE300 V1.2.3, BL-F1200_AT1 V1.0.0, BL-X26_AC8EPSS 1.6%CVE-2025-45986CRITICALBlink routers BL-WR9000 V2.4.9 , BL-AC2100_AZ3 V1.0.4, BL-X10_AC8 v1.0.5 , BL-LTE300 v1.2.3, BL-F1200_AT1 v1.0.0, BL-X26_AC8 v1.2.8, BLAC450EPSS 1.6%