Falhas do tipo CWE-78
4.605 resultadosInjeção de comando do sistema operacional
A aplicação constrói comandos do SO usando dados de entrada do usuário sem sanitização adequada, permitindo que um atacante injete comandos adicionais. Quando o comando é executado, instruções maliciosas do atacante rodam com os privilégios da aplicação, comprometendo o servidor.
Exemplo
Um script PHP que executa `system('ping ' . $_GET['host'])` sem validar o parâmetro. Um atacante passa `8.8.8.8; rm -rf /` e consegue deletar arquivos do servidor, não apenas fazer ping.
Como mitigar
Sempre valide e sanitize entrada de usuário; prefira APIs seguras (como funções que aceitam argumentos separados em vez de strings de comando); execute com menor privilégio necessário; use listas brancas de valores permitidos quando possível.
CVE-2024-41622HIGHD-Link DIR-846W A1 FW100A43 was discovered to contain a remote command execution (RCE) vulnerability via the tomography_ping_address parametEPSS 2.0%CVE-2024-1655HIGHASUS WiFi Router - OS Command InjectionEPSS 2.0%CVE-2023-51984CRITICALD-Link DIR-822+ V1.0.2 was found to contain a command injection in SetStaticRouteSettings function. allows remote attackers to execute arbitEPSS 2.0%CVE-2026-62928CRITICALXING CPTrans-ME-X contains an OS Command Injection (CWE-78). Unauthenticated OS command may be injected.EPSS 2.0%CVE-2025-22398CRITICALDell Unity, version(s) 5.4 and prior, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS Command InjectionEPSS 2.0%CVE-2021-28204HIGHASUS BMC's firmware: command injection - Modify user’s information functionEPSS 2.0%CVE-2025-27106HIGHCode injection in binance-trading-botEPSS 2.0%CVE-2025-69212CRITICALOpenSTAManager has an OS Command Injection in P7M File ProcessingEPSS 2.0%CVE-2026-26331HIGHyt-dlp: Arbitrary Command Injection when using the `--netrc-cmd` optionEPSS 2.0%CVE-2026-46420MEDIUMsetup-php: Command Injection in Repository-Derived PHP Version ResolutionEPSS 2.0%CVE-2024-40584MEDIUMAn improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability [CWE-78] in Fortinet FortiAnalyzEPSS 2.0%CVE-2026-22229HIGHCommand Injection Vulnerability on TP-Link Archer BE230 v1.2 and Deco BE25 v1.0EPSS 2.0%CVE-2026-19042HIGHCommand Injection in TeamViewer Desktop Client for Linux through Chat Link HandlingEPSS 2.0%CVE-2026-56688CRITICALDell PowerFlex Manager, Version prior to 5.1.0.1, contain(s) an Improper Neutralization of Special Elements used in an OS Command ('OS CommaEPSS 2.0%CVE-2026-26943HIGHDell PowerProtect Data Domain, versions 7.7.1.0 through 8.6, LTS2025 release version 8.3.1.0 through 8.3.1.20, LTS2024 release versions 7.13EPSS 2.0%CVE-2026-53478HIGHDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 2.0%CVE-2026-70419CRITICALDell Cloud Disaster Recovery, versions 20.2 and prior, contain an Improper Neutralization of Special Elements used in an OS Command ('OS ComEPSS 2.0%CVE-2026-54796HIGHDell OpenManage Enterprise, versions prior to 4.7.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS CommEPSS 2.0%CVE-2026-23501HIGHDell RecoverPoint for VMs, versions 6.0.3 and 6.0.3.1, contains an Improper Neutralization of Special Elements used in an OS Command ('OS CoEPSS 2.0%CVE-2026-49814HIGHDell PowerProtect Data Domain, versions 7.7.1.0 through 8.7, LTS2026 release version 8.6.1.0 through 8.6.1.10, LTS2025 release version 8.3.1EPSS 2.0%