Falhas do tipo CWE-78
5.060 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2024-4814MEDIUMRuijie RG-UAC static_route_edit_commit.php os command injectionEPSS 6.4%CVE-2024-4816MEDIUMRuijie RG-UAC gre_add_commit.php os command injectionEPSS 6.4%CVE-2023-3607MEDIUMkodbox WebConsole Plug-In webconsole.php.txt Execute os command injectionEPSS 6.4%CVE-2026-2081MEDIUMD-Link DIR-823X set_password os command injectionEPSS 6.4%CVE-2024-29224CRITICALAn OS command injection vulnerability exists in the NAT parameter of GoCast 1.1.3. A specially crafted HTTP request can lead to arbitrary coEPSS 6.3%CVE-2013-10060CRITICALNetgear Routers pppoe.cgi RCEEPSS 6.3%CVE-2021-4473CRITICALTianxin Internet Behavior Management System Command Injection via toQuery.phpEPSS 6.3%CVE-2026-28517CRITICALopenDCIM <= 23.04 OS Command Injection via dot Configuration ParameterEPSS 6.3%CVE-2026-111215HIGHNetgate pfSense CE through 2.9.0 OS Command Injection via Wireless Parent InterfaceEPSS 6.2%CVE-2025-34095CRITICALMako Server v2.5 and v2.6 OS Command Injection via examples/save.lspEPSS 6.2%CVE-2022-42484CRITICALAn OS command injection vulnerability exists in the httpd logs/view.cgi functionality of FreshTomato 2022.5. A specially crafted HTTP requesEPSS 6.2%CVE-2026-111225LOWNetgate pfSense CE 2.5.0 through 2.9.0 OS Command Injection via openvpn.learn-address.shEPSS 6.2%CVE-2026-111560HIGHOS Command Injection in Barracuda AppliancesEPSS 6.2%KEVCVE-2022-43325CRITICALAn unauthenticated command injection vulnerability in the product license validation function of Telos Alliance Omnia MPX Node 1.3.* - 1.4.*EPSS 6.2%CVE-2024-24329CRITICALTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setPortFEPSS 6.2%CVE-2024-24328HIGHTOTOLINK A3300R V17.0.0cu.557_B20221024 was discovered to contain a command injection vulnerability via the enable parameter in the setMacFiEPSS 6.2%CVE-2025-3816MEDIUMwestboy CicadasCMS Scheduled Task save os command injectionEPSS 6.2%CVE-2026-8272MEDIUMD-Link DNS-320 webfile_mgr.cgi chown os command injectionEPSS 6.1%CVE-2026-110908HIGHNetgate pfSense FRR package (pfSense-pkg-frr) 2.0.2_1 and source revision 2.1.2_1 contain an OS command injection vulnerability in the FRR sEPSS 6.1%CVE-2013-10061HIGHNetgear Routers setup.cgi RCEEPSS 6.1%