Falhas do tipo CWE-78
5.061 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2019-1885HIGHCisco Integrated Management Controller Command Injection VulnerabilityEPSS 3.8%CVE-2021-30166HIGHMERIT LILIN ENT.CO.,LTD. P2/Z2/P3/Z3 IP camera - Command InjectionEPSS 3.8%CVE-2022-31249HIGH[RANCHER] OS command injection in Rancher and FleetEPSS 3.8%CVE-2022-50791HIGHSOUND4 IMPACT/FIRST/PULSE/Eco <=2.x Conditional Command Injection via ping.phpEPSS 3.8%CVE-2026-9151HIGHCommand Injection Vulnerability in OpenVPN on Multiple TP-Link Archer RoutersEPSS 3.8%CVE-2024-2910MEDIUMRuijie RG-EG350 HTTP POST Request vpnAction os command injectionEPSS 3.7%CVE-2023-48842CRITICALD-Link Go-RT-AC750 revA_v101b03 was discovered to contain a command injection vulnerability via the service parameter at hedwig.cgi.EPSS 3.7%CVE-2023-4412MEDIUMTOTOLINK EX1200L setWanCfg os command injectionEPSS 3.7%CVE-2023-4410MEDIUMTOTOLINK EX1200L setDiagnosisCfg os command injectionEPSS 3.7%CVE-2022-24796CRITICALRemote Command Injection in RaspberryMaticEPSS 3.7%CVE-2026-26068CRITICALemp3r0r Agent-Controlled Metadata to Operator RCE (tmux Command Injection)EPSS 3.7%CVE-2026-86299CRITICALLinksys RE7000 PingTest json.cgi platform_event_pingTest os command injectionEPSS 3.7%CVE-2026-4499MEDIUMD-Link DIR-820LW SSDP ssdpcgi_main os command injectionEPSS 3.7%CVE-2022-33189CRITICALAn OS command injection vulnerability exists in the XCMD setAlexa functionality of Abode Systems, Inc. iota All-In-One Security Kit 6.9Z. A EPSS 3.7%CVE-2025-15254MEDIUMTenda W6-S ATE Service ate TendaAte os command injectionEPSS 3.7%CVE-2025-9262MEDIUMwong2 mcp-cli oAuth provider.js redirectToAuthorization os command injectionEPSS 3.7%CVE-2023-24595HIGHAn OS command injection vulnerability exists in the ys_thirdparty system_user_script functionality of Milesight UR32L v32.3.0.5. A speciallyEPSS 3.7%CVE-2026-19771HIGHBaicells EG3661M LuCI Web luci os command injectionEPSS 3.7%CVE-2023-24805HIGHCommand injection in cups-filtersEPSS 3.7%CVE-2024-5421HIGHAuthenticated Command InjectionEPSS 3.7%