Falhas do tipo CWE-78
5.061 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2022-39947HIGHA improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiADC version 7.0.0 through 7.0.EPSS 3.0%CVE-2024-8077MEDIUMTOTOLINK AC1200 T8 setTracerouteCfg os command injectionEPSS 2.9%CVE-2021-21015HIGHMagento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code ExecutionEPSS 2.9%CVE-2026-86148CRITICALTenda CP3 Kylin system.c SystemAsh os command injectionEPSS 2.9%CVE-2026-86151CRITICALTenda CP3 Network Configuration Management system.c sub_2F77E8 os command injectionEPSS 2.9%CVE-2026-86149CRITICALTenda CP3 NetCheckPing.cpp os command injectionEPSS 2.9%CVE-2018-17558CRITICALHardcoded manufacturer credentials and an OS command injection vulnerability in the /cgi-bin/mft/ directory on ABUS TVIP TVIP20050 LM.1.6.18EPSS 2.9%CVE-2026-19188CRITICALHaiwell IoT Cloud HMI Gateway OS Command InjectionEPSS 2.9%CVE-2026-52102CRITICALAn OS command injection vulnerability in the openmediavault-md plugin of OpenMediaVault v8.0.4-1 allows attackers to execute arbitrary commaEPSS 2.9%CVE-2026-58457CRITICALShenzhen Aitemi M300 MT02 Unauthenticated OS Command Injection via protocol.cspEPSS 2.9%CVE-2026-37751CRITICALAn OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attacEPSS 2.9%CVE-2024-53939HIGHAn issue was discovered in Victure RX1800 WiFi 6 Router (software EN_V1.0.0_r12_110933, hardware 1.0) devices. The /cgi-bin/luci/admin/opsw/EPSS 2.9%CVE-2026-110536CRITICALD-Link DIR-868L HNAP CGI cgibin system os command injectionEPSS 2.9%CVE-2025-56085HIGHOS Command Injection vulnerability in Ruijie RG-EW1200 EW_3.0(1)B11P227_EW1200_11130208RG-EW1200 V1.00 allowing attackers to execute arbitraEPSS 2.9%CVE-2026-27551HIGHCommand Injection in /index.php/ajax/parameterManageEPSS 2.9%CVE-2026-27550HIGHCommand Injection in Field_Shadow_Password ClassEPSS 2.9%CVE-2026-27547HIGHCommand Injection in /index.php/ajax/get_iodd_menu_infoEPSS 2.9%CVE-2026-27558HIGHCommand Injection in /index.php/attached_devices_tab/ajax_remove_uploaded_iodd_filesEPSS 2.9%CVE-2026-27548HIGHCommand Injection in /index.php/ajax/get_iodd_port_infoEPSS 2.9%CVE-2026-27554HIGHCommand Injection in /index.php/ajax/save_iodd_parametersEPSS 2.9%