Falhas do tipo CWE-77

2.807 resultados

Injeção de comando

O software monta comandos do sistema ou de interpretadores (shell, SQL, etc.) usando dados que vêm de fora (entrada do usuário, requisição HTTP, arquivo) sem sanitizar ou sanitizando incorretamente caracteres especiais. Um atacante consegue 'fechar' o comando legítimo e injetar comandos arbitrários que serão executados com os mesmos privilégios da aplicação.

Exemplo

Um script que executa `ping` no endereço fornecido pelo usuário: `system('ping ' + user_input)`. Se o usuário digita `8.8.8.8; rm -rf /`, o comando executado vira dois: primeiro o ping, depois a deleção de arquivos. A maioria das CVEs de injeção de comando vêm deste padrão.

Como mitigar

Use APIs que aceitam argumentos como lista (não concatenação de strings) — ex: subprocess.run(['ping', user_input]) em Python ou parameterized queries em banco de dados. Se precisar de interpretador, valide rigorosamente a entrada com lista branca (aceita apenas IP/domínio válido) e evite shells intermediários.

CVE-2024-22651CRITICALThere is a command injection vulnerability in the ssdpcgi_main function of cgibin binary in D-Link DIR-815 router firmware v1.04.EPSS 20.2%CVE-2025-44084CRITICALD-link DI-8100 16.07.26A1 is vulnerable to Command Injection. An attacker can exploit this vulnerability by crafting specific HTTP requests,EPSS 20.1%CVE-2025-3002MEDIUMDigital China DCME-520 mon_merge_stat_hist.php os command injectionEPSS 20.0%CVE-2025-10775MEDIUMWavlink WL-NU516U1 login.cgi sub_4012A0 os command injectionEPSS 20.0%CVE-2024-7464MEDIUMTOTOLINK CP900 Telnet Service setTelnetCfg command injectionEPSS 19.9%CVE-2024-33344CRITICALD-Link DIR-822+ V1.0.5 was found to contain a command injection in ftext function of upload_firmware.cgi, which allows remote attackers to eEPSS 19.9%CVE-2025-7081MEDIUMBelkin F9K1122 webs formSetWanStatic os command injectionEPSS 19.7%CVE-2025-14093MEDIUMEdimax BR-6478AC V3 formTracerouteDiagnosticRun sub_416990 os command injectionEPSS 19.6%CVE-2025-13442MEDIUMUTT 进取 750W formPdbUpConfig system command injectionEPSS 19.5%CVE-2026-3064MEDIUMHummerRisk Cloud Task Scheduler ResourceCreateService.java command injectionEPSS 19.5%CVE-2024-7922MEDIUMD-Link DNS-1550-04 myMusic.cgi cgi_write_playlist command injectionEPSS 19.5%CVE-2024-53333MEDIUMTOTOLINK EX200 v4.0.3c.7646_B20201211 was found to contain a command insertion vulnerability in the setUssd function. This vulnerability allEPSS 19.4%CVE-2024-25850CRITICALNetis WF2780 v2.1.40144 was discovered to contain a command injection vulnerability via the wps_ap_ssid5g parameterEPSS 19.1%CVE-2025-14706CRITICALShiguangwu sgwbox N3 NETREBOOT http_eshell_server command injectionEPSS 18.6%CVE-2025-14707CRITICALShiguangwu sgwbox N3 DOCKER Feature http_eshell_server command injectionEPSS 18.6%CVE-2023-49237CRITICALAn issue was discovered on TRENDnet TV-IP1314PI 5.5.3 200714 devices. Command injection can occur because the system function is used by davEPSS 18.6%CVE-2026-4197MEDIUMD-Link DNS-1550-04 download_mgr.cgi RSS_Item_List command injectionEPSS 18.4%CVE-2025-9424MEDIUMRuijie WS7204-A branch_import.php os command injectionEPSS 18.3%CVE-2024-10429HIGHWAVLINK WN530H4/WN530HG4/WN572HG3 internet.cgi set_ipv6 command injectionEPSS 18.2%CVE-2010-4345HIGHExim 4.72 and earlier allows local users to gain privileges by leveraging the ability of the exim user account to specify an alternate confiEPSS 18.0%KEV