Falhas do tipo CWE-78
5.060 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2023-4711MEDIUMD-Link DAR-8000-10 decodmail.php os command injectionEPSS 6.8%CVE-2025-11665MEDIUMD-Link DAP-2695 Firmware Update rgbin fwupdater_main os command injectionEPSS 6.8%CVE-2024-41473HIGHTenda FH1201 v1.2.0.14 was discovered to contain a command injection vulnerability via the mac parameter at ip/goform/WriteFacMacEPSS 6.7%CVE-2023-24229HIGHDrayTek Vigor2960 v1.5.1.4 allows an authenticated attacker with network access to the web management interface to inject operating system cEPSS 6.7%CVE-2024-4504MEDIUMRuijie RG-UAC commit.php os command injectionEPSS 6.7%CVE-2025-65202HIGHTRENDnet TEW-657BRM 1.00.1 has an authenticated remote OS command injection vulnerability in the setup.cgi binary, exploitable via the HTTP EPSS 6.7%CVE-2017-10955HIGHThis vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of EMC Data Protection Advisor 6.3.0. AutheEPSS 6.7%CVE-2026-3101MEDIUMIntelbras TIP 635G Ping os command injectionEPSS 6.6%CVE-2019-5142HIGHAn exploitable command injection vulnerability exists in the hostname functionality of the Moxa AWK-3131A firmware version 1.13. A speciallyEPSS 6.6%CVE-2019-25065MEDIUMOpenNetAdmin os command injectionEPSS 6.6%CVE-2026-2142HIGHD-Link DIR-823X set_qos sub_420688 os command injectionEPSS 6.6%CVE-2025-34082CRITICALIGEL OS Secure Terminal and Secure Shadow Remote Code ExecutionEPSS 6.6%CVE-2026-111226HIGHNetgate pfSense CE 2.4.5 through 2.9.0 OS Command Injection via system_advanced_admin.phpEPSS 6.5%CVE-2024-33112HIGHD-Link DIR-845L router v1.01KRb03 and before is vulnerable to Command injection via the hnap_main()func.EPSS 6.5%CVE-2024-28892CRITICALAn OS command injection vulnerability exists in the name parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary cEPSS 6.5%CVE-2017-14001—An Improper Neutralization of Special Elements used in an OS Command issue was discovered in Digium Asterisk GUI 2.1.0 and prior. An OS commEPSS 6.4%CVE-2023-6319CRITICALCommand injection in the getAudioMetadata method from the com.webos.service.attachedstoragemanager serviceEPSS 6.4%CVE-2024-4813MEDIUMRuijie RG-UAC interface_commit.php os command injectionEPSS 6.4%CVE-2024-4815MEDIUMRuijie RG-UAC detail.php os command injectionEPSS 6.4%CVE-2023-53941CRITICALEasyPHP Webserver 14.1 Remote Code ExecutionEPSS 6.4%