An issue was discovered on Securifi Almond Almond+ and Almond 2015 devices with firmware AL-R096. The device provides a user with the capability of adding new routes to the device. It seems that the POST parameters passed in this request to set up routes on the device can be set in such a way that would result in passing commands to a \popen\ API in the function and thus result in command injection on the device. If the firmware version AL-R096 is dissected using binwalk tool we obtain a cpio-root archive which contains the filesystem set up on the device that contains all the binaries. The binary \goahead\ is the one that has the vulnerable function that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows a MIPS little endian format. The function sub_00420F38 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \dest\ is extracted at address 0x00420FC4. The POST parameter \dest is concatenated in a route add command and this is passed to a \popen\ function at address 0x00421220. This allows an attacker to provide the payload of his/her choice and finally take control of the device.


An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the POST parameters passed in this request (to test if email credentials and hostname sent to the device work properly) result in being passed as commands to a \system\ API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The library \libmailutils.so\ is the one that has the vulnerable function \sub_1FC4\ that receives the values sent by the POST request. If we open this binary in IDA-pro we will notice that this follows an ARM little endian format. The function sub_1FC4 in IDA pro is identified to be receiving the values sent in the POST request and the value set in POST parameter \receiver1\ is extracted in function \sub_15AC\ which is then passed to the vulnerable system API call. The vulnerable library function is accessed in \cgibox\ binary at address 0x0008F598 which calls the \mailLoginTest\ function in \libmailutils.so\ binary as shown below which results in the vulnerable POST parameter being passed to the library which results in the command injection issue.


Atlassian SourceTree v2.5c and prior are affected by a command injection in the handling of the sourcetree:// scheme. It will lead to arbitrary OS command execution with a URL substring of sourcetree://cloneRepo/ext:: or sourcetree://checkoutRef/ext:: followed by the command. The Atlassian ID number is SRCTREE-4632.


FusionSphere OpenStack V100R006C00SPC102(NFV)has a command injection vulnerability. Due to lack of validation an attacker with high privilege may inject malicious code into some module of the affected products causing code execution.


An issue was discovered on D-Link DCS-1130 devices. The device provides a user with the capability of setting a SMB folder for the video clippings recorded by the device. It seems that the GET parameters passed in this request (to test if SMB credentials and hostname sent to the device work properly) result in being passed as commands to a \system\ API in the function and thus result in command injection on the device. If the firmware version is dissected using binwalk tool we obtain a cramfs-root archive which contains the filesystem set up on the device that contains all the binaries. The binary \cgibox\ is the one that has the vulnerable function \sub_7EAFC\ that receives the values sent by the GET request. If we open this binary in IDA-pro we will notice that this follows a ARM little endian format. The function sub_7EAFC in IDA pro is identified to be receiving the values sent in the GET request and the value set in GET parameter \user\ is extracted in function sub_7E49C which is then passed to the vulnerable system API call.


The mail gem before 2.5.5 for Ruby (aka A Really Ruby Mail Library) is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command as demonstrated by CRLF sequences immediately before and after a DATA substring.


Net::SMTP in Ruby before 2.4.0 is vulnerable to SMTP command injection via CRLF sequences in a RCPT TO or MAIL FROM command as demonstrated by CRLF sequences immediately before and after a DATA substring.


picocom before 2.0 has a command injection vulnerability in the 'send and receive file' command because the command line is executed by /bin/sh unsafely.


clientcommands in Nexuiz before 2.2.1 has unknown impact and remote attack vectors related to \remote console command injection.\


Microsoft FTP Service 7.0 and 7.5 for Internet Information Services (IIS) processes unspecified commands before TLS is enabled for a session which allows remote attackers to obtain sensitive information by reading the replies to these commands aka \FTP Command Injection Vulnerability.\


A command injection (missing input validation escaping) in the ftp upgrade configuration interface on the Auerswald COMfort 1200 IP phone 3.4.4.1-10589 allows an authenticated remote attacker (simple user) -- in the same network as the device -- to trigger OS commands (like starting telnetd or opening a reverse shell) via a POST request to the web server.


D-Link DIR-822 Rev.B 202KRb06 DIR-822 Rev.C 3.10B06 DIR-860L Rev.B 2.03.B03 DIR-868L Rev.B 2.05B02 DIR-880L Rev.A 1.20B01_01_i3se_BETA and DIR-890L Rev.A 1.21B02_BETA devices mishandle IsAccessPoint in /HNAP1/SetAccessPointMode. In the SetAccessPointMode.php source code the IsAccessPoint parameter is saved in the ShellPath script file without any regex checking. After the script file is executed the command injection occurs. A vulnerable /HNAP1/SetAccessPointMode XML message could have shell metacharacters in the IsAccessPoint element such as the `telnetd` string.


In Geutebrueck GmbH E2 Camera Series versions prior to 1.12.0.25 the DDNS configuration (in the Network Configuration panel) is vulnerable to an OS system command injection as root.


If exploited this command injection vulnerability could allow remote attackers to run arbitrary commands. QNAP has already fixed the issue in the following QTS versions. QTS 4.4.2.1231 on build 20200302; QTS 4.4.1.1201 on build 20200130; QTS 4.3.6.1218 on build 20200214; QTS 4.3.4.1190 on build 20200107; QTS 4.3.3.1161 on build 20200109; QTS 4.2.6 on build 20200109.


In the /HNAP1/SetClientInfoDemo message the AudioMute and AudioEnable parameters are vulnerable and the vulnerabilities affect D-Link DIR-868L Rev.B 2.05B02 devices. In the SetClientInfoDemo.php source code the AudioMute and AudioEnble parameters are saved in the ShellPath script file without any regex checking. After the script file is executed the command injection occurs. It needs to bypass the wget command option with a single quote. A vulnerable /HNAP1/SetClientInfoDemo XML message could have single quotes and backquotes in the AudioMute or AudioEnable element such as the '`telnetd`' string.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects WAC505 before 5.0.0.17 and WAC510 before 5.0.0.17.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D6100 before 1.0.0.57 R6100 before 1.0.1.20 R7500v2 before 1.0.3.24 WNDR4300v2 before 1.0.0.50 and WNDR4500v3 before 1.0.0.50.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6220 before 1.1.0.64 and WNDR3700v5 before 1.1.0.54.


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects WC7500 before 6.5.3.9 WC7520 before 6.5.3.9 WC7600v1 before 6.5.3.9 and WC7600v2 before 6.5.3.9.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.44 R7500v2 before 1.0.3.38 R7800 before 1.0.2.52 R8900 before 1.0.4.12 and R9000 before 1.0.4.12.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

and

before


The traceroute (aka node-traceroute) package through 1.0.0 for Node.js allows remote command injection via the host parameter. This occurs because the Child.exec() method which is considered to be not entirely safe is used. In particular an OS command can be placed after a newline character.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WAC505 before 5.0.5.4 and WAC510 before 5.0.5.4.


In Vecna VGo Robot versions prior to 3.0.3.52164 an attacker on an adjacent network could perform command injection.


A command injection vulnerability exists in the Microsoft Wireless Display Adapter (MWDA) when the Microsoft Wireless Display Adapter does not properly manage user input aka \Microsoft Wireless Display Adapter Command Injection Vulnerability.\ This affects Microsoft Wireless Display Adapter V2 Software.


An issue was discovered on Cerner Connectivity Engine (CCE) 4 devices. The hostname timezone and NTP server configurations on the CCE device are vulnerable to command injection by sending a crafted configuration file over the network.


An issue was discovered on Teracue ENC-400 devices with firmware 2.56 and below. The login form passes user input directly to a shell command without any kind of escaping or validation in /usr/share/www/check.lp file. An attacker is able to perform command injection using the \password\ parameter in the login form.


Multiple command injection vulnerabilities in NeDi before 1.7Cp3 allow authenticated users to execute code on the server side via the flt parameter to Nodes-Traffic.php the dv parameter to Devices-Graph.php or the tit parameter to drawmap.php.


There was an command injection vulnerability in Sourcetree for Windows from version 0.5a before version 3.0.10 via URI handling. A remote attacker could send a malicious URI to a victim using Sourcetree for Windows to exploit this issue to gain code execution on the system.


An issue was discovered in ASUSWRT 3.0.0.4.384.20308. When processing the /start_apply.htm POST data there is a command injection issue via shell metacharacters in the fb_email parameter. By using this issue an attacker can control the router and get shell.


in

/apply.cgi

on

ASUS

and

devices

before

devices

before

and

devices

before

and

devices

before

allows

OS

command

injection

via

the

pingCNT

and

destIP

fields

of

the

SystemCmd

variable.


For some Iomega Lenovo LenovoEMC NAS devices versions 4.1.402.34662 and earlier when joining a PersonalCloud setup an attacker can craft a command injection payload using backtick \``\ characters in the client:password parameter. As a result arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.


For some Iomega Lenovo LenovoEMC NAS devices versions 4.1.402.34662 and earlier when changing the name of a share an attacker can craft a command injection payload using backtick \``\ characters in the share : name parameter. As a result arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.


An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.


For some Iomega Lenovo LenovoEMC NAS devices versions 4.1.402.34662 and earlier when changing the name of a share an attacker can craft a command injection payload using backtick \``\ characters in the name parameter. As a result arbitrary commands may be executed as the root user. The attack requires a value __c and iomega parameter.


The remote upgrade feature in Guardzilla GZ180 devices allow command injection via a crafted new firmware version parameter.


Cerio DT-300N 1.1.6 through 1.1.12 devices allow OS command injection because of improper input validation of the web-interface PING feature's use of Save.cgi to execute a ping command as exploited in the wild in October 2018.


An exploitable vulnerability exists in the smart cameras RTSP configuration of the Samsung SmartThings Hub STH-ETH-250 - Firmware version 0.20.17. The device incorrectly handles spaces in the URL field leading to an arbitrary operating system command injection. An attacker can send a series of HTTP requests to trigger this vulnerability.


Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAMData entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal it enters a code path that calls a function named 'set_host_domain_name' from its libshared.so shared object.


An exploitable command injection vulnerability exists in the measurementBitrateExec functionality of Sony IPELA E Series Network Camera G5 firmware 1.87.00. A specially crafted GET request can cause arbitrary commands to be executed. An attacker can send an HTTP request to trigger this vulnerability.


An exploitable operating system command injection exists in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04). Specially crafted entries to network configuration information can cause execution of arbitrary system commands resulting in full control of the device. An attacker can send an authenticated HTTP request to trigger this vulnerability. Data entered into the 'Domain Name' input field through the web portal is submitted to apply.cgi as the value to the 'wan_domain' POST parameter. The wan_domain data goes through the nvram_set process described above. When the 'preinit' binary receives the SIGHUP signal it enters a code path that calls a function named 'set_host_domain_name' from its libshared.so shared object.


An exploitable code execution vulnerability exists in the cloud OTA setup functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted SSID can cause a command injection resulting in code execution. An attacker can cause a camera to connect to this SSID to trigger this vulnerability. Alternatively an attacker can convince a user to connect their camera to this SSID.


Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal it enters a code path that continues until it reaches offset 0x0042B5C4 in the 'start_lltd' function. Within the 'start_lltd' function a 'nvram_get' call is used to obtain the value of the user-controlled 'machine_name' NVRAM entry. This value is then entered directly into a command intended to write the host name to a file and subsequently executed.


An exploitable command injection vulnerability exists in the gplotMakeOutput function of Leptonica 1.74.4. A specially crafted gplot rootname argument can cause a command injection resulting in arbitrary code execution. An attacker can provide a malicious path as input to an application that passes attacker data to this function to trigger this vulnerability.


An exploitable command injection vulnerability exists in the DHCP daemon configuration of the CUJO Smart Firewall. When adding a new static DHCP address its corresponding hostname is inserted into the dhcpd.conf file without prior sanitization allowing for arbitrary execution of system commands. To trigger this vulnerability an attacker can send a DHCP request message and set up the corresponding static DHCP entry.


An exploitable code execution vulnerability exists in the firmware update functionality of Yi Home Camera 27US 1.8.7.0D. A specially crafted file can cause a logic flaw and command injection resulting in code execution. An attacker can insert an SD card to trigger this vulnerability.


SV3C L-SERIES HD CAMERA V2.3.4.2103-S50-NTD-B20170508B and V2.3.4.2103-S50-NTD-B20170823B devices allow OS Command Injection.


acccheck.pl in acccheck 0.2.1 allows Command Injection via shell metacharacters in a username or password file as demonstrated by injection into an smbclient command line.


The

Ping

and

Traceroute

features

on

TP-Link

Build

devices

allow

authenticated

blind

Command

Injection.


The Symantec Reporter CLI 10.1 prior to 10.1.5.6 and 10.2 prior to 10.2.1.8 is susceptible to an OS command injection vulnerability. An authenticated malicious administrator with Enable mode access can execute arbitrary OS commands with elevated system privileges.


The macaddress module before 0.2.9 for Node.js is prone to an arbitrary command injection flaw due to allowing unsanitized input to an exec (rather than execFile) call.


Command injection vulnerability in Helpdesk versions 1.1.21 and earlier in QNAP QTS 4.2.6 build 20180531 QTS 4.3.3 build 20180528 QTS 4.3.4 build 20180528 and their earlier versions could allow remote attackers to run arbitrary commands in the compromised application.


A vulnerability in specific CLI commands for the Cisco Identity Services Engine (ISE) could allow an authenticated local attacker to perform command injection to the underlying operating system or cause a hang or disconnect of the user session. The attacker needs valid administrator credentials for the device. The vulnerability is due to incomplete input validation of user input for certain CLI ISE configuration commands. An attacker could exploit this vulnerability by authenticating as an administrative user issuing a specific CLI command and entering crafted malicious user input for the command parameters. An exploit could allow the attacker to perform command injection to the lower-level Linux operating system. It is also possible the attacker could cause the ISE user interface for this management session to hang or disconnect. Cisco Bug IDs: CSCvg95479.


In order to perform actions that require higher privileges the Quest KACE System Management Appliance 8.0.318 relies on a message queue that runs daemonized with root privileges and only allows a set of commands to be executed. A command injection vulnerability exists within this message queue which allows low-privilege users to append arbitrary commands that will be run as root.


NETGEAR has released fixes for a pre-authentication command injection in request_handler.php security vulnerability on the following product models: WC7500 running firmware versions prior to 6.5.3.5; WC7520 running firmware versions prior to 2.5.0.46; WC7600v1 running firmware versions prior to 6.5.3.5; WC7600v2 running firmware versions prior to 6.5.3.5; and WC9500 running firmware versions prior to 6.5.3.5.


An issue was discovered on Moxa AWK-3121 1.14 devices. It provides functionality so that an administrator can run scripts on the device to troubleshoot any issues. However the same functionality allows an attacker to execute commands on the device. The POST parameter \iw_filename\ is susceptible to command injection via shell metacharacters.


An issue was discovered on Dasan GPON home routers. Command Injection can occur via the dest_host parameter in a diag_action=ping request to a GponForm/diag_Form URI. Because the router saves ping results in /tmp and transmits them to the user when the user revisits /diag.html it's quite simple to execute commands and retrieve their output.


An issue was discovered in multiple models of Axis IP Cameras. There is Shell Command Injection.


All Phoenix Contact managed FL SWITCH 3xxx 4xxx 48xx products running firmware version 1.0 to 1.33 are prone to OS command injection.


Dell EMC RecoverPoint versions prior to 5.1.2 and RecoverPoint for VMs versions prior to 5.1.1.3 contains a command injection vulnerability in the Boxmgmt CLI. An authenticated malicious user with boxmgmt privileges may potentially exploit this vulnerability to read RPA files. Note that files that require root permission cannot be read.


Dell EMC ScaleIO versions prior to 2.5 contain a command injection vulnerability in the Light Installation Agent (LIA). This component is used for central management of ScaleIO deployment and uses shell commands for certain actions. A remote malicious user with network access to LIA and knowledge of the LIA administrative password could potentially exploit this vulnerability to run arbitrary commands as root on the systems where LIAs are installed.


An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1 EMC RecoverPoint version 5.1.0.0 and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Boxmgmt CLI may allow a malicious user with boxmgmt privileges to bypass Boxmgmt CLI and run arbitrary commands with root privileges.


An issue was discovered in EMC RecoverPoint for Virtual Machines versions prior to 5.1.1 EMC RecoverPoint version 5.1.0.0 and EMC RecoverPoint versions prior to 5.0.1.3. Command injection vulnerability in Admin CLI may allow a malicious user with admin privileges to escape from the restricted shell to an interactive shell and run arbitrary commands with root privileges.


Dell EMC Unity Operating Environment (OE) versions prior to 4.3.0.1522077968 are affected by multiple OS command injection vulnerabilities. A remote application admin user could potentially exploit the vulnerabilities to execute arbitrary OS commands as system root on the system where Dell EMC Unity is installed.


Github Electron version Electron 1.8.2-beta.4 and earlier contains a Command Injection vulnerability in Protocol Handler that can result in command execute. This attack appear to be exploitable via the victim opening an electron protocol handler in their browser. This vulnerability appears to have been fixed in Electron 1.8.2-beta.5. This issue is due to an incomplete fix for CVE-2018-1000006 specifically the black list used was not case insensitive allowing an attacker to potentially bypass it.


PHKP

version

including

commit

contains

a

Improper

Neutralization

of

Special

Elements

used

in

a

Command

('Command

Injection')

vulnerability

in

function

that

can

result

in

It

is

possible

to

manipulate

gpg-keys

or

execute

commands

remotely.

This

attack

appear

to

be

exploitable

via

HKP-Api:

/pks/lookup?search.


OpenEMR version 5.0.0 contains a OS Command Injection vulnerability in fax_dispatch.php that can result in OS command injection by an authenticated attacker with any role. This vulnerability appears to have been fixed in 5.0.0 Patch 2 or higher.


GIG

Technology

NV

JumpScale

Portal

version

before

commit

contains

a

Improper

Neutralization

of

Special

Elements

used

in

an

OS

Command

('OS

Command

Injection')

vulnerability

in

method:

notifySpaceModification;

that

can

result

in

Improper

validation

of

parameters

results

in

command

execution.

This

attack

appear

to

be

exploitable

via

Network

connectivity

required

minimal

auth

privileges

(everyone

can

register

an

account).

This

vulnerability

appears

to

have

been

fixed

in

After

commit


Security Onion Solutions Squert version 1.3.0 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in .inc/callback.php that can result in execution of OS Commands. This attack appear to be exploitable via Web request to .inc/callback.php with the payload in the data or obj parameters used in autocat(). This vulnerability appears to have been fixed in 1.7.0.


Security Onion Solutions Squert version 1.0.1 through 1.6.7 contains a CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection) vulnerability in .inc/callback.php that can result in execution of OS Commands. This attack appear to be exploitable via Web request to .inc/callback.php with the payload in the txdata parameter used in tx()/transcript() or the catdata parameter used in cat(). This vulnerability appears to have been fixed in 1.7.0.


Green Packet WiMax DV-360 2.10.14-g1.0.6.1 devices allow Command Injection with unauthenticated remote command execution via a crafted payload to the HTTPS port because lighttpd listens on all network interfaces (including the external Internet) by default. NOTE: this may overlap CVE-2017-9980.


** DISPUTED ** Vivotek FD8136 devices allow Remote Command Injection aka \another command injection vulnerability in our target device \ a different issue than CVE-2018-14494. NOTE: The vendor has disputed this as a vulnerability and states that the issue does not cause a web server crash or have any other affect on it's performance.


A system command injection vulnerability in zyshclient in ZyXEL NSA325 V2 version 4.81 allows attackers to execute system commands via the web application API.


** DISPUTED ** Vivotek FD8136 devices allow Remote Command Injection related to BusyBox and wget. NOTE: the vendor sent a clarification on 2019-09-17 explaining that although this CVE was first populated in July 2019 it is a historical vulnerability that does not apply to any current or recent Vivotek hardware or firmware.


Seagate Media Server in Seagate Personal Cloud has unauthenticated command injection in the uploadTelemetry and getLogs functions in views.py because .psp URLs are handled by the fastcgi.server component and shell metacharacters are mishandled.


Command injection vulnerability in Citrix NetScaler ADC and NetScaler Gateway 11.0 before build 70.16 11.1 before build 55.13 and 12.0 before build 53.13; and the NetScaler Load Balancing instance distributed with NetScaler SD-WAN/CloudBridge 4000 4100 5000 and 5100 WAN Optimization Edition 9.3.0 allows remote attackers to execute a system command or read arbitrary files via an SSH login prompt.


The Crestron Console service running on DGE-100 DM-DGE-200-C and TS-1542-C devices with default configuration and running firmware versions 1.3384.00049.001 and lower are vulnerable to command injection that can be used to gain root-level access.


The Norton Core router prior to v237 may be susceptible to a command injection exploit. This is a type of attack in which the goal is execution of arbitrary commands on the host system via vulnerable software.


Adobe Dreamweaver CC versions 18.0 and earlier have an OS Command Injection vulnerability. Successful exploitation could lead to arbitrary code execution in the context of the current user.


Adobe Connect versions 9.7 and earlier have an exploitable OS Command Injection. Successful exploitation could lead to arbitrary file deletion.


An exploitable command injection vulnerability exists in the ACEManager iplogging.cgi functionality of Sierra Wireless AirLink ES450 FW 4.9.3. A specially crafted HTTP request can inject arbitrary commands resulting in arbitrary command execution. An attacker can send an authenticated HTTP request to trigger this vulnerability.


The Logitech Harmony Hub before version 4.15.206 is vulnerable to OS command injection via the time update request. A remote server or man in the middle can inject OS commands with a properly formatted response.


The Logitech Harmony Hub before version 4.15.206 is vulnerable to application level command injection via crafted HTTP request. An unauthenticated remote attacker can leverage this vulnerability to execute application defined commands (e.g. harmony.system?systeminfo).


NUUO NVRMini2 version 3.9.1 is vulnerable to authenticated remote command injection. An attacker can send crafted requests to upgrade_handle.php to execute OS commands as root.


fileshare.cmd on Telus Actiontec T2200H T2200H-31.128L.03 devices allows OS Command Injection via shell metacharacters in the smbdUserid or smbdPasswd field.


The

Plainview

Activity

Monitor

plugin

before

for

WordPress

is

vulnerable

to

OS

command

injection

via

shell

metacharacters

in

the

ip

parameter

of

a

wp-admin/admin.php?page=plainview_activity_monitor&tab=activity_tools

request.


Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection providing an attacker with full root access via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi (scripts that can be discovered with binwalk on the firmware but are not visible in the web interface). This occurs because shell metacharacters in the query string are mishandled by ShellExecute as demonstrated by the zbtest.cgi?cmd=level&level= substring. This can also be exploited via CSRF.


An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/form2systime.cgi route. This could lead to command injection via shell metacharacters in the datetime parameter.


An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/NTPSyncWithHost route. This could lead to command injection via shell metacharacters.


A Command Injection issue was discovered in Citrix SD-WAN 10.1.0 and NetScaler SD-WAN 9.3.x before 9.3.6 and 10.0.x before 10.0.4.


An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction in the handler function of the /goform/Diagnosis route. This could lead to command injection via shell metacharacters in the sendNum parameter.


An issue was discovered on D-Link DSL-3782 devices with firmware 1.01. An OS command injection vulnerability in Acl.asp allows a remote authenticated attacker to execute arbitrary OS commands via the ScrIPaddrEndTXT parameter.


The

web

application

on

Xerox

AltaLink

before

before

before

and

before

allows

unauthenticated

command

injection.


An issue was discovered on D-Link DIR-816 A2 1.10 B05 devices. An HTTP request parameter is used in command string construction within the handler function of the /goform/sylogapply route. This could lead to command injection via the syslogIp parameter after /goform/clearlog is invoked.


OS command injection vulnerability in soap.cgi (soapcgi_main in cgibin) in D-Link DIR-880L DIR-880L_REVA_FIRMWARE_PATCH_1.08B04 and previous versions DIR-868L DIR868LA1_FW112b04 and previous versions DIR-65L DIR-865L_REVA_FIRMWARE_PATCH_1.08.B01 and previous versions and DIR-860L DIR860LA1_FW110b04 and previous versions allows remote attackers to execute arbitrary OS commands via the service parameter.


A server auth command injection authentication bypass vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.3 and below could allow remote attackers to escalate privileges on vulnerable installations.


An issue was discovered in Leptonica through 1.75.3. The gplotMakeOutput function allows command injection via a $(command) approach in the gplot rootname argument. This issue exists because of an incomplete fix for CVE-2018-3836.


A command injection vulnerability is present that permits an unauthenticated user with access to the Aruba Instant web interface to execute arbitrary system commands within the underlying operating system. An attacker could use this ability to copy files read configuration write files delete files or reboot the device. Workaround: Block access to the Aruba Instant web interface from all untrusted users. Resolution: Fixed in Aruba Instant 4.2.4.12 6.5.4.11 8.3.0.6 and 8.4.0.1


In Schneider Electric U.motion Builder software versions prior to v1.3.4 a remote command injection allows authentication bypass.


The test connection functionality in the NetAudit section of Opsview Monitor before 5.3.1 and 5.4.x before 5.4.2 is vulnerable to command injection due to improper sanitization of the rancid_password parameter.


An issue was discovered in mgetty before 1.2.1. In fax/faxq-helper.c the function do_activate() does not properly sanitize shell metacharacters to prevent command injection. It is possible to use the || && or > characters within a file created by the \faxq-helper activate <jobid>\ command.


An issue was discovered in mgetty before 1.2.1. In fax_notify_mail() in faxrec.c the mail_to parameter is not sanitized. It could allow for command injection if untrusted input can reach it because popen is used.


Aruba

Instant

prior

to

prior

to

prior

to

and

prior

to

allows

Command

injection.


An authenticated command injection vulnerability exists in status_interfaces.php via dhcp_relinquish_lease() in pfSense before 2.4.4 due to its passing user input from the $_POST parameters \ifdescr\ and \ipv\ to a shell without escaping the contents of the variables. This allows an authenticated WebGUI user with privileges for the affected page to execute commands in the context of the root user when submitting a request to relinquish a DHCP lease for an interface which is configured to obtain its address via DHCP.


A command injection (missing input validation escaping) in the monitoring or memory status web interface in AudioCodes 405HD (firmware 2.2.12) VoIP phone allows an authenticated remote attacker in the same network as the device to trigger OS commands (like starting telnetd or opening a reverse shell) via a POST request to the web server. In combination with another attack (unauthenticated password change) the attacker can circumvent the authentication requirement.


The network diagnostic function (ping) in the Yeahlink Ultra-elegant IP Phone SIP-T41P (firmware 66.83.0.35) allows a remote authenticated attacker to trigger OS commands or open a reverse shell via command injection.


A command Injection in ps package versions <1.0.0 for Node.js allowed arbitrary commands to be executed when attacker controls the PID.


The web management console of Opsview Monitor 5.4.x before 5.4.2 provides functionality accessible by an authenticated administrator to test notifications that are triggered under certain configurable events. The value parameter is not properly sanitized leading to arbitrary command injection with the privileges of the nagios user account.


KLog Server 2.4.1 allows OS command injection via shell metacharacters in the actions/authenticate.php user parameter.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.58 R7500v2 before 1.0.3.46 R7800 before 1.0.2.74 R8900 before 1.0.5.2 and R9000 before 1.0.5.2.


NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an unauthenticated attacker.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7500v2 before 1.0.3.48 R8900 before 1.0.5.2 R9000 before 1.0.5.2 and R7800 before 1.0.2.68.


NETGEAR DGN2200v1 devices before v1.0.0.58 are affected by command injection.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects D7800 before 1.0.1.56 R7800 before 1.0.2.68 R8900 before 1.0.4.26 and R9000 before 1.0.4.26.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


NETGEAR NMS300 devices before 1.6.0.27 are affected by command injection by an authenticated user.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R7800 before 1.0.2.68 R8900 before 1.0.5.2 and R9000 before 1.0.5.2.


** DISPUTED ** The Yale WIPC-303W 2.21 through 2.31 camera is vulnerable to remote command execution (RCE) through command injection via the HTTP API. NOTE: This may be a duplicate of CVE-2020-10176 .


rConfig 3.9.5 allows command injection by sending a crafted GET request to lib/ajaxHandlers/ajaxArchiveFiles.php since the path parameter is passed directly to the exec function without being escaped.


Unibox U-50 2.4 and UniBox Enterprise Series 2.4 and UniBox Campus Series 2.4 contain a OS command injection vulnerability in /tools/ping which can leads to complete device takeover.


iWT Ltd FaceSentry Access Control System 6.4.8 suffers from an authenticated OS command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user via the 'strInIP' POST parameter in pingTest PHP script.


Inim Electronics SmartLiving SmartLAN/G/SI <=6.x suffers from an authenticated remote command injection vulnerability. The issue exist due to the 'par' POST parameter not being sanitized when called with the 'testemail' module through web.cgi binary. The vulnerable CGI binary (ELF 32-bit LSB executable ARM) is calling the 'sh' executable via the system() function to issue a command using the mailx service and its vulnerable string format parameter allowing for OS command injection with root privileges. An attacker can remotely execute system commands as the root user using default credentials and bypass access controls in place.


The Patient Portal of OpenEMR 5.0.2.1 is affected by a Command Injection vulnerability in /interface/main/backup.php. To exploit the vulnerability an authenticated attacker can send a POST request that executes arbitrary OS commands via shell metacharacters.


oal_ipt_addBridgeIsolationRules on TP-Link TL-WR840N 6_EU_0.9.1_4.16 devices allows OS command injection because a raw string entered from the web interface (an IP address field) is used directly for a call to the system library function (for iptables). NOTE: oal_ipt_addBridgeIsolationRules is not the only function that calls util_execSystem.


TinyCheck before commits 9fd360d and ea53de8 was vulnerable to command injection due to insufficient checks of input parameters in several places.


Improper Neutralization of Special Elements used in a Command ('Command Injection') vulnerability in HTTP interface of ADT LifeShield DIY HD Video Doorbell allows an attacker on the same network to execute commands on the device. This issue affects: ADT LifeShield DIY HD Video Doorbell version 1.0.02R09 and prior versions.


There is an OS command injection vulnerability in Ruby Rake < 12.3.3 in Rake::FileList when supplying a filename that begins with the pipe character `|`.


fs-path node module before 0.0.25 is vulnerable to command injection by way of user-supplied inputs via the `copy` `copySync` `remove` and `removeSync` methods.


OS

Command

Injection

vulnerability

in

the

wirelessConnect

handler

of

Abode

iota

All-In-One

Security

Kit

allows

an

attacker

to

inject

commands

and

gain

root

access.

This

issue

affects:

Abode

iota

All-In-One

Security

Kit

versions

prior

to

1.0.2.23_6.9V_dev_t2_homekit_RF_2.0.19_s2_kvsABODE

oz.


OS Command injection vulnerability in function link in Filesystem.php in Laravel Framework before 5.8.17.


Command Injection in Simiki v1.6.2.1 and prior allows remote attackers to execute arbitrary system commands via line 64 of the component 'simiki/blob/master/simiki/config.py'.


The D-Link DSR-250 (3.14) DSR-1000N (2.11B201) UPnP service contains a command injection vulnerability which can cause remote command execution.


FusionCompute 8.0.0 have a command injection vulnerability. The software does not sufficiently validate certain parameters post from user successful exploit could allow an authenticated attacker to launch a command injection attack.


A vulnerability exists that could allow the execution of unauthorized code or operating system commands on systems running exacqVision Web Service versions 20.06.3.0 and prior and exacqVision Enterprise Manager versions 20.06.4.0 and prior. An attacker with administrative privileges could potentially download and run a malicious executable that could allow OS command injection on the system.


Huawei FusionCompute versions 6.5.1 and 8.0.0 have a command injection vulnerability. An authenticated remote attacker can craft specific request to exploit this vulnerability. Due to insufficient verification this could be exploited to cause the attackers to obtain higher privilege.


ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the TRACE field of the resource ping.cmd. The NTP-2 device is also affected.


Adobe Download Manager version 2.0.0.518 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.


ELTEX NTP-RG-1402G 1v10 3.25.3.32 devices allow OS command injection via the PING field of the resource ping.cmd. The NTP-2 device is also affected.


An issue was discovered in the box application on HiSilicon based IPTV/H.264/H.265 video encoders. The file-upload endpoint does not enforce authentication. Attackers can send an unauthenticated HTTP request to upload a custom firmware component possibly in conjunction with command injection to achieve arbitrary code execution.


CGI implementation in Yaws web server versions 1.81 to 2.0.7 is vulnerable to OS command injection.


tz.pl on XoruX LPAR2RRD and STOR2RRD 2.70 virtual appliances allows cmd=set&tz=OS command injection via shell metacharacters in a timezone.


Grandstream GRP261x VoIP phone running firmware version 1.0.3.6 (Base) allows Command Injection as root in its administrative web interface.


LogRhythm Platform Manager 7.4.9 allows Command Injection. To exploit this an attacker can inject arbitrary program names and arguments into a WebSocket. These are forwarded to any remote server with a LogRhythm Smart Response agent installed. By default the commands are run with LocalSystem privileges.


An issue was discovered on D-Link DCS-2530L before 1.06.01 Hotfix and DCS-2670L through 2.02 devices. cgi-bin/ddns_enc.cgi allows authenticated command injection.


The web console for Mimosa B5 B5c and C5x firmware through 2.8.0.2 allows authenticated command injection in the Throughput WANStats PhyStats and QosStats API classes. An attacker with access to a web console account may execute operating system commands on affected devices by sending crafted POST requests to the affected endpoints (/core/api/calls/Throughput.php /core/api/calls/WANStats.php /core/api/calls/PhyStats.php /core/api/calls/QosStats.php). This results in the complete takeover of the vulnerable device. This vulnerability does not occur in the older 1.5.x firmware versions.


D-Link DNS-320 FW v2.06B01 Revision Ax is affected by command injection in the system_mgr.cgi component which can lead to remote arbitrary code execution.


NETGEAR R8300 devices before 1.0.2.134 are affected by command injection by an unauthenticated attacker.


Maxum Rumpus 8.2.13 and 8.2.14 is affected by a command injection vulnerability. The web administration contains functionality in which administrators are able to manage users. The edit users form contains a parameter vulnerable to command injection due to insufficient validation.


osCommerce Phoenix CE before 1.0.5.4 allows OS command injection remotely. Within admin/mail.php a from POST parameter can be passed to the application. This affects the PHP mail function and the sendmail -f option.


Rostelecom CS-C2SHW 5.0.082.1 is affected by: Bash command injection. The camera reads configuration from QR code (including network settings). The static IP configuration from QR code is copied to the file /config/ip-static and after reboot data from this file is inserted into bash command (without any escaping). So bash injection is possible. Camera doesn't parse QR codes if it's already successfully configured. Camera is always rebooted after successful configuration via QR code.


An exploitable unatuhenticated command injection exists in the OpenClinic GA 5.173.3. Specially crafted web requests can cause commands to be executed on the server. An attacker can send a web request with parameters containing specific parameter to trigger this vulnerability potentially allowing exfiltration of the database user credentials and compromise underlying operating system.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

and

before


npm package systeminformation before version 4.30.5 is vulnerable to Prototype Pollution leading to Command Injection. The issue was fixed with a rewrite of shell sanitations to avoid prototyper pollution problems. The issue is fixed in version 4.30.5. If you cannot upgrade be sure to check or sanitize service parameter strings that are passed to si.inetChecksite().


In systeminformation (npm package) before version 4.31.1 there is a command injection vulnerability. The problem was fixed in version 4.31.1 with a shell string sanitation fix.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects WC7500 before 6.5.5.24 WC7600 before 6.5.5.24 WC7600v2 before 6.5.5.24 and WC9500 before 6.5.5.24.


systeminformation is an npm package that provides system and OS information library for node.js. In systeminformation before version 4.26.2 there is a command injection vulnerability. Problem was fixed in version 4.26.2 with a shell string sanitation fix.


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects RBK852 before 3.2.16.6 RBR850 before 3.2.16.6 and RBS850 before 3.2.16.6.


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects D7800 before 1.0.1.58 and R7500v2 before 1.0.3.48.


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects SRK60 before 2.5.3.110 SRR60 before 2.5.3.110 and SRS60 before 2.5.3.110.


Ruckus through 1.5.1.0.21 is affected by remote command injection. An authenticated user can submit a query to the API (/service/v1/createUser endpoint) injecting arbitrary commands that will be executed as root user via web.py.


Certain NETGEAR devices are affected by command injection by an authenticated user. This affects R6220 before 1.1.0.100 and R6230 before 1.1.0.100.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

and

before


Improper Input Validation in Eaton's Intelligent Power Manager (IPM) v 1.67 & prior on file name during configuration file import functionality allows attackers to perform command injection or code execution via specially crafted file names while uploading the configuration file in the application.


The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request which can be controlled by the website. If a user used the 'Copy as Curl' feature and pasted the command into a terminal it could have resulted in command injection and arbitrary command execution. This vulnerability affects Thunderbird < 68.6 Firefox < 74 Firefox < ESR68.6 and Firefox ESR < 68.6.


Nagios NRPE 3.2.1 has Insufficient Filtering because for example nasty_metachars interprets \\n as the character \\ and the character n (not as the \\n newline sequence). This can cause command injection.


Firejail through 0.9.62 does not honor the -- end-of-options indicator after the --output option which may lead to command injection.


Firejail through 0.9.62 mishandles shell metacharacters during use of the --output or --output-stderr option which may lead to command injection.


Winston 1.5.4 devices are vulnerable to command injection via the API.


clamscan through 1.2.0 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the `_is_clamav_binary` function located within `Index.js`. It should be noted that this vulnerability requires a pre-requisite that a folder should be created with the same command that will be chained to execute. This lowers the risk of this issue.


An issue was discovered on KT Slim egg IML500 (R7283 R8112 R8424) and IML520 (R8112 R8368 R8411) wifi device. This issue is a command injection allowing attackers to execute arbitrary OS commands.


Cayin CMS suffers from an authenticated OS semi-blind command injection vulnerability using default credentials. This can be exploited to inject and execute arbitrary shell commands as the root user through the 'NTP_Server_IP' HTTP POST parameter in system.cgi page. This issue affects several branches and versions of the CMS application including CME-SE CMS-60 CMS-40 CMS-20 and CMS version 8.2 8.0 and 7.5.


karma-mojo through 1.0.1 is vulnerable to Command Injection. It allows execution of arbitrary commands via the config argument.


node-mpv through 1.4.3 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.


adb-driver through 0.1.8 is vulnerable to Command Injection.It allows execution of arbitrary commands via the command function.


The package bestzip before 2.1.7 are vulnerable to Command Injection via the options param.


Improper Input validation vulnerability exists in Netis Korea D'live AP which could cause arbitrary command injection and execution when the time setting (using ntpServerlp1 parameter) for the users. This affects D'live set-top box AP(WF2429TB) v1.1.10.


apiconnect-cli-plugins through 6.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via the pluginUri argument.


The package ng-packagr before 10.1.1 are vulnerable to Command Injection via the styleIncludePaths option.


In MaEPSBroker 2.5.0.31 and prior a command injection vulnerability caused by improper input validation checks when parsing brokerCommand parameter.


jscover through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary command via the source argument.


node-key-sender through 1.0.11 is vulnerable to Command Injection. It allows execution of arbitrary commands via the 'arrParams' argument in the 'execute()' function.


diskusage-ng through 0.2.4 is vulnerable to Command Injection.It allows execution of arbitrary commands via the path argument.


install-package through 0.4.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the options argument.


compass-compile through 0.0.1 is vulnerable to Command Injection.It allows execution of arbitrary commands via tha options argument.


strong-nginx-controller through 1.0.2 is vulnerable to Command Injection. It allows execution of arbitrary command as part of the '_nginxCmd()' function.


npm-programmatic through 0.0.12 is vulnerable to Command Injection.The packages and option properties are concatenated together without any validation and are used by the 'exec' function directly.


op-browser through 1.0.6 is vulnerable to Command Injection. It allows execution of arbitrary commands via the url function.


Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to be imported by Metasploit from a variety of sources and trigger a command injection on the operator's terminal. Note only the Metasploit Framework and products that expose the plugin system is susceptible to this issue -- notably this does not include Rapid7 Metasploit Pro. Also note this vulnerability cannot be triggered through a normal scan operation -- the attacker would have to supply a file that is processed with the db_import command.


The EasyCorp ZenTao Pro application suffers from an OS command injection vulnerability in its '/pro/repo-create.html' component. After authenticating to the ZenTao dashboard attackers may construct and send arbitrary OS commands via the POST parameter 'path' and those commands will run in an elevated SYSTEM context on the underlying Windows operating system.


pomelo-monitor through 0.3.7 is vulnerable to Command Injection.It allows injection of arbitrary commands as part of 'pomelo-monitor' params.


The EFM ipTIME C200 IP Camera is affected by a Command Injection vulnerability in /login.cgi?logout=1 script. To exploit this vulnerability an attacker can send a GET request that executes arbitrary OS commands via cookie value.


fsa through 0.5.1 is vulnerable to Command Injection. The first argument of 'execGitCommand()' located within 'lib/rep.js#63' can be controlled by users without any sanitization to inject arbitrary commands.


effect through 1.0.4 is vulnerable to Command Injection. It allows execution of arbitrary command via the options argument.


An OS Command Injection vulnerability in the endpoint_devicemap.php component of Fonality Trixbox Community Edition allows an attacker to execute commands on the underlying operating system as the \asterisk\ user. Note that Trixbox Community Edition has been unsupported by the vendor since 2012. This issue affects: Fonality Trixbox Community Edition versions 1.2.0 through 2.8.0.4. Versions 1.0 and 1.1 are unaffected.


Sage X3 System CHAINE Variable Script Command Injection. An authenticated user with developer access can pass OS commands via this variable used by the web application. Note this developer configuration should not be deployed in production.


git-add-remote through 1.0.0 is vulnerable to Command Injection. It allows execution of arbitrary commands via the name argument.


umount through 1.1.6 is vulnerable to Command Injection. The argument device can be controlled by users without any sanitization.


get-git-data through 1.3.1 is vulnerable to Command Injection. It is possible to inject arbitrary commands as part of the arguments provided to get-git-data.


heroku-addonpool through 0.1.15 is vulnerable to Command Injection.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action pppoe_connect ru_pppoe_connect or dhcp_connect with the key wan_ifname (or wan0_dns) allowing an authenticated user to run arbitrary commands on the device.


There is command injection in the meshd program in the routing system resulting in command execution under administrator authority on Xiaomi router AX3600 with ROM version =< 1.1.12


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

and

before


There is command injection in the addMeshNode interface of xqnetwork.lua which leads to command execution under administrator authority on Xiaomi router AX3600 with rom versionrom< 1.1.12


TRENDnet TEW-827DRU devices through 2.06B04 contain multiple command injections in apply.cgi via the action send_log_email with the key auth_acname (or auth_passwd) allowing an authenticated user to run arbitrary commands on the device.


There is command injection when ddns processes the hostname which causes the administrator user to obtain the root privilege of the router. This affects Xiaomi router AX1800rom version < 1.0.336 and Xiaomi route RM1800 root version < 1.0.26.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

unauthenticated

attacker.

This

affects

before

before

before

before

before

before

and

before


Dell EMC OpenManage Enterprise-Modular (OME-M) versions prior to 1.10.00 contain a command injection vulnerability. A remote authenticated malicious user with high privileges could potentially exploit the vulnerability to execute arbitrary shell commands on the affected system.


Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via SSH. An authenticated remote attacker can execute commands as the root user by issuing a specially crafted \unset\ command.


Dell EMC Integrated Data Protection Appliance versions 2.0 2.1 2.2 2.3 2.4 contain a command injection vulnerability in the ACM component. A remote authenticated malicious user with root privileges could inject parameters in the ACM component APIs that could lead to manipulation of passwords and execution of malicious commands on ACM component.


Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can execute commands as the root user by sending a crafted HTTP GET to the UCM's \Old\ HTTPS API.


Grandstream UCM6200 series firmware version 1.0.20.23 and below is vulnerable to OS command injection via HTTP. An authenticated remote attacker can bypass command injection mitigations and execute commands as the root user by sending a crafted HTTP POST to the UCM's \New\ HTTPS API.


A vulnerability in SonicWall SMA100 appliance allow an authenticated management-user to perform OS command injection using HTTP POST parameters. This vulnerability affected SMA100 Appliance version 10.2.0.2-20sv and earlier.


Certain IBM Aspera applications are vulnerable to command injection after valid authentication which could allow an attacker with intimate knowledge of the system to execute commands in a SOAP API. IBM X-Force ID: 180810.


VMware Workspace One Access Access Connector Identity Manager and Identity Manager Connector address have a command injection vulnerability.


** DISPUTED ** scp in OpenSSH through 8.3p1 allows command injection in the scp.c toremote function as demonstrated by backtick characters in the destination argument. NOTE: the vendor reportedly has stated that they intentionally omit validation of \anomalous argument transfers\ because that could \stand a great chance of breaking existing workflows.\


In codecov (npm package) before version 3.7.1 the upload method has a command injection vulnerability. Clients of the codecov-node library are unlikely to be aware of this so they might unwittingly write code that contains a vulnerability. A similar CVE (CVE-2020-7597 for GHSA-5q88-cjfq-g2mh) was issued but the fix was incomplete. It only blocked & and command injection is still possible using backticks instead to bypass the sanitizer. The attack surface is low in this case. Particularly in the standard use of codecov where the module is used directly in a build pipeline not built against as a library in another application that may supply malicious input and perform command injection.


An issue was discovered on D-Link DIR-816L devices 2.x before 1.10b04Beta02. Universal Plug and Play (UPnP) is enabled by default on port 1900. An attacker can perform command injection by injecting a payload into the Search Target (ST) field of the SSDP M-SEARCH discover packet.


In iPear the manual execution of the eval() function can lead to command injection. Only PCs where commands are manually executed via \For Developers\ are affected. This function allows executing any PHP code within iPear which may change damage or steal data (files) from the PC.


An issue was found in Apache Airflow versions 1.10.10 and below. A remote code/command injection vulnerability was discovered in one of the example DAGs shipped with Airflow which would allow any authenticated user to run arbitrary commands as the user running airflow worker/scheduler (depending on the executor in use). If you already have examples disabled by setting load_examples=False in the config then you are not vulnerable.


An issue was discovered in Open-AudIT 3.2.2. There is OS Command injection in Discovery.


sendfax.php in iFAX AvantFAX before 3.3.6 and HylaFAX Enterprise Web Interface before 0.2.5 allows authenticated Command Injection.


Certain

NETGEAR

devices

are

affected

by

command

injection

by

an

authenticated

user.

This

affects

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

before

and

before


Certain NETGEAR devices are affected by command injection by an unauthenticated attacker. This affects R6400v2 before 1.0.4.84 R6700 before 1.0.2.8 R6700v3 before 1.0.4.84 R6900 before 1.0.2.8 and R7900 before 1.0.3.10.


An issue was discovered in Svakom Siime Eye 14.1.00000001.3.330.0.0.3.14. A command injection vulnerability resides in the HOST/IP section of the NFS settings menu in the webserver running on the device. By injecting Bash commands via shell metacharacters here the device executes arbitrary code with root privileges (all of the device's services are running as root).


Zeroshell 3.9.3 contains a command injection vulnerability in the /cgi-bin/kerbynet StartSessionSubmit parameter that could allow an unauthenticated attacker to execute a system command by using shell metacharacters and the %0a character.


An issue was discovered on V-SOL V1600D V2.03.69 and V2.03.57 V1600D4L V1.01.49 V1600D-MINI V1.01.48 V1600G1 V2.0.7 and V1.9.7 and V1600G2 V1.1.4 OLT devices. Command injection can occur in \upload tftp syslog\ and \upload tftp configuration\ in the CLI via a crafted filename.


Certain Zyxel products allow command injection by an admin via an input string to chg_exp_pwd during a password-change action. This affects VPN On-premise before ZLD V4.39 week38 VPN Orchestrator before SD-OS V10.03 week32 USG before ZLD V4.39 week38 USG FLEX before ZLD V4.55 week38 ATP before ZLD V4.55 week38 and NSG before 1.33 patch 4.


Dell EMC PowerStore versions prior to 1.0.3.0.5.006 contain an OS Command Injection vulnerability in PowerStore X environment . A locally authenticated attacker could potentially exploit this vulnerability leading to the execution of arbitrary OS command on the PowerStore underlying OS. Exploiting may lead to a system take over by an attacker.


A command injection issue in dji_sys in DJI Mavic 2 Remote Controller before firmware version 01.00.0510 allows for code execution via a malicious firmware upgrade packet.


DELL EMC Avamar Server versions 19.1 19.2 19.3 contain an OS Command Injection Vulnerability in Fitness Analyzer. A remote unauthenticated attacker could potentially exploit this vulnerability leading to the execution of arbitrary OS commands on the application's underlying OS with high privileges. This vulnerability is considered critical as it can be leveraged to completely compromise the vulnerable application as well as the underlying operating system. Dell recommends customers to upgrade at the earliest opportunity.


Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation or Code Execution as root via vectors related to corrupt component installation in cmd_subsys.php.


A command injection vulnerability in AddVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.


Liferay Portal Server tested on 7.3.5 GA6 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject Groovy script to execute any OS command on the Liferay Portal Sever.


An issue was discovered in SaltStack Salt before 3002.5. The minion's restartcheck is vulnerable to command injection via a crafted process name. This allows for a local privilege escalation by any user able to create a files on the minion in a non-blacklisted directory.


A command injection vulnerability in ModifyVLANItem of Trend Micro InterScan Web Security Virtual Appliance 6.5 SP2 could allow an authenticated remote attacker to send specially crafted HTTP messages and execute arbitrary OS commands with elevated privileges.


Command Injection in Nagios Fusion 4.1.8 and earlier allows for Privilege Escalation to nagios.


** DISPUTED ** Liferay Portal Server tested on 7.3.5 GA6 7.2.0 GA1 is affected by OS Command Injection. An administrator user can inject commands through the Gogo Shell module to execute any OS command on the Liferay Portal Sever. NOTE: The developer disputes this as a vulnerability since it is a feature for administrators to access and execute commands in Gogo Shell and therefore not a design flaw


Command Injection in Nagios Fusion 4.1.8 and earlier allows Privilege Escalation from apache to root in cmd_subsys.php.


The package async-git before 1.13.2 are vulnerable to Command Injection via shell meta-characters (back-ticks). For example: git.reset('atouch HACKEDb')


A

vulnerability

in

the

HTTP/HTTPS

service

used

by

J-Web

Web

Authentication

Dynamic-VPN

(DVPN)

Firewall

Authentication

Pass-Through

with

Web-Redirect

and

Zero

Touch

Provisioning

(ZTP)

allows

an

unauthenticated

attacker

to

perform

local

file

inclusion

(LFI)

or

path

traversal.

Using

this

vulnerability

an

attacker

may

be

able

to

inject

commands

into

the

httpd.log

read

files

with

'world'

readable

permission

file

or

obtain

J-Web

session

tokens.

In

the

case

of

command

injection

as

the

HTTP

service

runs

as

user

'nobody'

the

impact

of

this

command

injection

is

limited.

(CVSS

score

vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

In

the

case

of

reading

files

with

'world'

readable

permission

in

Junos

OS

and

above

the

unauthenticated

attacker

would

be

able

to

read

the

configuration

file.

(CVSS

score

vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

If

J-Web

is

enabled

the

attacker

could

gain

the

same

level

of

access

of

anyone

actively

logged

into

J-Web.

If

an

administrator

is

logged

in

the

attacker

could

gain

administrator

access

to

J-Web.

(CVSS

score

vector

This

issue

only

affects

Juniper

Networks

Junos

OS

devices

with

HTTP/HTTPS

services

enabled.

Junos

OS

devices

with

HTTP/HTTPS

services

disabled

are

not

affected.

If

HTTP/HTTPS

services

are

enabled

the

following

command

will

show

the

httpd

processes:

user@device>

show

system

processes

match

http

S

-N

I

--config

To

summarize:

If

HTTP/HTTPS

services

are

disabled

there

is

no

impact

from

this

vulnerability.

If

HTTP/HTTPS

services

are

enabled

and

J-Web

is

not

in

use

this

vulnerability

has

a

CVSS

score

of

(CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N).

If

J-Web

is

enabled

this

vulnerability

has

a

CVSS

score

of

(CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

Juniper

SIRT

has

received

a

single

report

of

this

vulnerability

being

exploited

in

the

wild.

Out

of

an

abundance

of

caution

we

are

notifying

customers

so

they

can

take

appropriate

actions.

Indicators

of

Compromise:

The

may

have

indicators

that

commands

have

injected

or

files

being

accessed.

The

device

administrator

can

look

for

these

indicators

by

searching

for

the

string

patterns

or

in

using

the

following

command:

user@device>

show

log

httpd.log

match

If

this

command

returns

any

output

it

might

be

an

indication

of

malicious

attempts

or

simply

scanning

activities.

Rotated

logs

should

also

be

reviewed

using

the

following

command:

user@device>

show

log

match

user@device>

show

log

match

Note

that

a

skilled

attacker

would

likely

remove

these

entries

from

the

local

log

file

thus

effectively

eliminating

any

reliable

signature

that

the

device

had

been

attacked.

This

issue

affects

Juniper

Networks

Junos

OS

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to

version

and

later

versions;

versions

prior

to

version

and

later

versions;

versions

prior

to

versions

prior

to

versions

prior

to

versions

prior

to


GaussDB 200 with version of 6.5.1 have a command injection vulnerability. The software constructs part of a command using external input from users but the software does not sufficiently validate the user input. Successful exploit could allow the attacker to inject certain commands.


A shell command injection vulnerability in the PAN-OS CLI allows a local authenticated user to escape the restricted shell and escalate privileges. This issue affects only PAN-OS 8.1 versions earlier than PAN-OS 8.1.13. This issue does not affect PAN-OS 7.1 PAN-OS 9.0 or later PAN-OS versions. This issue is fixed in PAN-OS 8.1.13 and all later versions.


Vesta Control Panel (VestaCP) through 0.9.8-26 allows Command Injection via the schedule/backup Backup Listing Endpoint. The attacker must be able to create a crafted filename on the server as demonstrated by an FTP session that renames .bash_logout to a .bash_logout' substring followed by shell metacharacters.


Comtrend VR-3033 DE11-416SSG-C01_R02.A2pvI042j1.d26m devices have Multiple Authenticated Command Injection vulnerabilities via the ping and traceroute diagnostic pages as demonstrated by shell metacharacters in the pingIpAddress parameter to ping.cgi.


rConfig before 3.9.5 allows command injection by sending a crafted GET request to lib/crud/search.crud.php since the nodeId parameter is passed directly to the exec function without being escaped.


/cgi-bin/activate.cgi on Draytek Vigor3900 Vigor2960 and Vigor300B devices before 1.5.1 allows remote attackers to achieve command injection via a remote HTTP request in DEBUG mode.


A command injection on the /admin/broadcast.php script of Invigo Automatic Device Management (ADM) through 5.0 allows remote authenticated attackers to execute arbitrary PHP code on the server as the user running the application.


OS Command Injection in export.php (vulnerable function called from include/functions-article.php) in Chadha PHPKB Standard Multi-Language 9 allows remote attackers to achieve Code Execution by saving the code to be executed as the wkhtmltopdf path via admin/save-settings.php.


Pepperl+Fuchs Comtrol IO-Link Master in Version 1.5.48 and below is prone to an authenticated blind OS Command Injection.


Pi-hole 4.4 allows a user able to write to /etc/pihole/dns-servers.conf to escalate privileges through command injection (shell metacharacters after an IP address).


Hicos citizen certificate client-side component does not filter special characters for command parameters in specific web URLs. An unauthenticated remote attacker can exploit this vulnerability to perform command injection attack to execute arbitrary system command disrupt system or terminate service.


Improper

Authorization

vulnerability

of

Pepperl+Fuchs

P+F

Comtrol

RocketLinx

(all

versions)

and

FW

and

below

is

prone

to

multiple

authenticated

command

injections.


The Web portal of the WiFi module of VPNCrypt M10 2.6.5 allows command injection via a text field which allow full control over this module's Operating System.


Beeline Smart Box 2.0.38 routers allow \Advanced settings > Other > Diagnostics\ OS command injection via the Ping ping_ipaddr parameter the Nslookup nslookup_ipaddr parameter or the Traceroute traceroute_ipaddr parameter.


Certain

TP-Link

devices

allow

Command

Injection.

This

affects

build

build

build

build

build

build

and

build


Certain

TP-Link

devices

allow

Command

Injection.

This

affects

build

and

build


Openfind MailGates contains a Command Injection flaw when receiving email with specific strings malicious code in the mail attachment will be triggered and gain unauthorized access to system files.


The 'Copy as cURL' feature of Devtools' network tab did not properly escape the HTTP method of a request which can be controlled by the website. If a user used the 'Copy as cURL' feature and pasted the command into a terminal it could have resulted in command injection and arbitrary command execution. *Note: this issue only affects Firefox on Windows operating systems.*. This vulnerability affects Firefox ESR < 68.8 Firefox < 76 and Thunderbird < 68.8.0.


Rebar3 versions 3.0.0-beta.3 to 3.13.2 are vulnerable to OS command injection via URL parameter of dependency specification.


The novish command-line interface included in NoviFlow NoviWare before NW500.2.12 and deployed on NoviSwitch devices is vulnerable to command injection in the \show status destination ipaddr\ command. This could be used by a read-only user (monitoring group) or admin to execute commands on the operating system.


The ATOS/Sips (aka Atos-Magento) community module 3.0.0 to 3.0.5 for Magento allows command injection.


Artica Proxy before 4.30.000000 Community Edition allows OS command injection via the Netbios name Server domain name dhclient_mac Hostname or Alias field. NOTE: this may overlap CVE-2020-10818.


emfd/libemf

in

Ruckus

Wireless

Unleashed

through

allows

a

remote

attacker

to

achieve

command

injection

via

a

crafted

HTTP

request.

This

affects

and

devices.


rkscli

in

Ruckus

Wireless

Unleashed

through

allows

a

remote

attacker

to

achieve

command

injection

and

jailbreak

the

CLI

via

a

crafted

CLI

command.

This

affects

and

devices.


A command injection vulnerability was discovered in Gitlab runner versions prior to 13.2.4 13.3.2 and 13.4.1. When the runner is configured on a Windows system with a docker executor which allows the attacker to run arbitrary commands on Windows host via DOCKER_AUTH_CONFIG build variable.


QuickBox Community Edition through 2.5.5 and Pro Edition through 2.1.8 allows an authenticated remote attacker to execute code on the server via command injection in the servicestart parameter.


SABnzbd 2.3.9 and 3.0.0Alpha2 has a command injection vulnerability in the web configuration interface that permits an authenticated user to execute arbitrary Python commands on the underlying operating system.


An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 8.1 versions earlier than PAN-OS 8.1.16; PAN-OS 9.0 versions earlier than PAN-OS 9.0.10; PAN-OS 9.1 versions earlier than PAN-OS 9.1.3.


An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect portal feature is not enabled. This issue impacts PAN-OS 9.1 versions earlier than PAN-OS 9.1.3; PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; PAN-OS 9.0 versions earlier than PAN-OS 9.0.9; all versions of PAN-OS 8.0 and PAN-OS 7.1. Prisma Access services are not impacted by this vulnerability.


An OS Command Injection vulnerability in PAN-OS management server allows authenticated administrators to execute arbitrary OS commands with root privileges when uploading a new certificate in FIPS-CC mode. This issue affects: All versions of PAN-OS 7.1 and PAN-OS 8.0; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13; PAN-OS 9.0 versions earlier than PAN-OS 9.0.7.


An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts PAN-OS 8.1 versions earlier than PAN-OS 8.1.15; and all versions of PAN-OS 7.1 and PAN-OS 8.0. This issue does not impact PAN-OS 9.0 PAN-OS 9.1 or Prisma Access services.


An OS Command Injection vulnerability in the PAN-OS management interface that allows authenticated administrators to execute arbitrary OS commands with root privileges. This issue impacts: PAN-OS 9.0 versions earlier than 9.0.10; PAN-OS 9.1 versions earlier than 9.1.4; PAN-OS 10.0 versions earlier than 10.0.1.


An OS Command Injection vulnerability in PAN-OS management server allows authenticated users to inject and execute arbitrary shell commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7.


An OS command injection vulnerability in PAN-OS management interface allows an authenticated administrator to execute arbitrary OS commands with root privileges. This issue affects: All versions of PAN-OS 7.1 and 8.0; PAN-OS 8.1 versions earlier than 8.1.14; PAN-OS 9.0 versions earlier than 9.0.7.


The vulnerability have been reported to affect earlier versions of QTS. If exploited this command injection vulnerability could allow remote attackers to run arbitrary commands. This issue affects: QNAP Systems Inc. Helpdesk versions prior to 3.0.3.


Jenkins Play Framework Plugin 1.0.2 and earlier lets users specify the path to the `play` command on the Jenkins master for a form validation endpoint resulting in an OS command injection vulnerability exploitable by users able to store such a file on the Jenkins master.


An OS Command Injection vulnerability in the PAN-OS web management interface allows authenticated administrators to execute arbitrary OS commands with root privileges by sending a malicious request to generate new certificates for use in the PAN-OS configuration. This issue affects: All versions of PAN-OS 8.0; PAN-OS 7.1 versions earlier than PAN-OS 7.1.26; PAN-OS 8.1 versions earlier than PAN-OS 8.1.13.


An exploitable command execution vulnerability exists in Information Builders WebFOCUS Business Intelligence Portal 8.1 . A specially crafted web parameter can cause a command injection. An authenticated attacker can send a crafted web request to trigger this vulnerability.


The Sophos Web Appliance (version 4.2.1.3) is vulnerable to two Remote Command Injection vulnerabilities affecting its web administrative interface. These vulnerabilities occur in the MgrReport.php (/controllers/MgrReport.php) component responsible for blocking and unblocking IP addresses from accessing the device. The device doesn't properly escape the information passed in the variables 'unblockip' and 'blockip' before calling the shell_exec() function which allows for system commands to be injected into the device. The code erroneously suggests that the information handled is protected by utilizing the variable name 'escapedips' - however this was not the case. The Sophos ID is NSWA-1258.


Blue Coat Advanced Secure Gateway (ASG) 6.6 before 6.6.5.4 and Content Analysis System (CAS) 1.3 before 1.3.7.4 are susceptible to an OS command injection vulnerability. An authenticated malicious administrator can execute arbitrary OS commands with elevated system privileges.


The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the 'viewcert' CGI (/cgi-bin/viewcert) component responsible for processing SSL certificate information. The CGI application doesn't properly escape the information it's passed in the 'CERT' variable before a call to system() is performed - allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account.


The Sophos Web Appliance Remote / Secure Web Gateway server (version 4.2.1.3) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. These vulnerabilities occur in MgrDiagnosticTools.php (/controllers/MgrDiagnosticTools.php) in the component responsible for performing diagnostic tests with the UNIX wget utility. The application doesn't properly escape the information passed in the 'url' variable before calling the executeCommand class function ($this->dtObj->executeCommand). This function calls exec() with unsanitized user input allowing for remote command injection. The page that contains the vulnerabilities /controllers/MgrDiagnosticTools.php is accessed by a built-in command answered by the administrative interface. The command that calls to that vulnerable page (passed in the 'section' parameter) is: 'configuration'. Exploitation of this vulnerability yields shell access to the remote machine under the 'spiderman' user account.


The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to two Remote Command Injection vulnerabilities in its web administrative interface. These vulnerabilities occur in the diagnostics CGI (/cgi-bin/diagnostics) component responsible for emailing out information about the state of the system. The application doesn't properly escape the information passed in the 'tsrDeleteRestartedFile' or 'currentTSREmailTo' variables before making a call to system() allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account.


An issue was discovered in Tesla Motors Model S automobile all firmware versions before version 7.1 (2.36.31) with web browser functionality enabled. The vehicle's Gateway ECU is susceptible to commands that may allow an attacker to install malicious software allowing the attacker to send messages to the vehicle's CAN bus a Command Injection.


The SonicWall Secure Remote Access server (version 8.1.0.2-14sv) is vulnerable to a Remote Command Injection vulnerability in its web administrative interface. This vulnerability occurs in the 'extensionsettings' CGI (/cgi-bin/extensionsettings) component responsible for handling some of the server's internal configurations. The CGI application doesn't properly escape the information it's passed when processing a particular multi-part form request involving scripts. The filename of the 'scriptname' variable is read in unsanitized before a call to system() is performed - allowing for remote command injection. Exploitation of this vulnerability yields shell access to the remote machine under the nobody user account. This is SonicWall Issue ID 181195.


An exploitable OS Command Injection vulnerability exists in the web application 'ping' functionality of Moxa AWK-3131A Wireless Access Points running firmware 1.1. Specially crafted web form input can cause an OS Command Injection resulting in complete compromise of the vulnerable device. An attacker can exploit this vulnerability remotely.


EMC Data Domain OS (DD OS) 5.4 all versions EMC Data Domain OS (DD OS) 5.5 family all versions prior to 5.5.5.0 EMC Data Domain OS (DD OS) 5.6 family all versions prior to 5.6.2.0 EMC Data Domain OS (DD OS) 5.7 family all versions prior to 5.7.2.10 has a command injection vulnerability that could potentially be exploited by malicious users to compromise the affected system.


An issue was discovered on the D-Link DWR-932B router. qmiweb allows command injection with ` characters.


An issue was discovered on SendQuick Entera and Avera devices before 2HF16. Multiple Command Injection vulnerabilities allow attackers to execute arbitrary system commands.


textract before 1.5.0 allows OS Command Injection attacks via a filename in a call to the process function. This may be a remote attack if a web application accepts names of arbitrary uploaded files.


An issue was discovered in Amanda 3.3.1. A user with backup privileges can trivially compromise a client installation. The \runtar\ setuid root binary does not check for additional arguments supplied after --create allowing users to manipulate commands and perform command injection as root.


Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/google_analytics.php URL via a modified arg parameter in the POST data.


An issue was discovered in Radisys MRF Web Panel (SWMS) 9.0.1. The MSM_MACRO_NAME POST parameter in /swms/ms.cgi was discovered to be vulnerable to OS command injection attacks. It is possible to use the pipe character (|) to inject arbitrary OS commands and retrieve the output in the application's responses. Attackers could execute unauthorized commands which could then be used to disable the software or read write and modify data for which the attacker does not have permissions to access directly. Since the targeted application is directly executing the commands instead of the attacker any malicious activities may appear to come from the application or the application's owner (apache user).


On Seowon Intech routers there is a Command Injection vulnerability in diagnostic.cgi via shell metacharacters in the ping_ipaddr parameter.


Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 index.php page via a modified Cookie header.


EMC RecoverPoint versions before 4.4.1.1 and EMC RecoverPoint for Virtual Machines versions before 5.0 are affected by multiple command injection vulnerabilities where a malicious administrator with configuration privileges may bypass the user interface and escalate his privileges to root.


Cisco TelePresence endpoints running either CE or TC software contain a vulnerability that could allow an authenticated local attacker to execute a local shell command injection. More Information: CSCvb25010. Known Affected Releases: 8.1.x. Known Fixed Releases: 6.3.4 7.3.7 8.2.2 8.3.0.


Opmantek NMIS before 4.3.7c has command injection via man finger ping trace and nslookup in the tools.pl CGI script. Versions before 8.5.12G might be affected in non-default configurations.


A command injection vulnerability exists in apply.cgi on the ASUS RP-AC52 access point firmware version 1.0.1.1s and possibly earlier web interface specifically in the action_script parameter. The action_script parameter specifies a script to be executed if the action_mode parameter does not contain a valid state. If the input provided by action_script does not match one of the hard coded options then it will be executed as the argument of either a system() or an eval() call allowing arbitrary commands to be executed.


The Apache Thrift Go client library exposed the potential during code generation for command injection due to using an external formatting tool. Affected Apache Thrift 0.9.3 and older Fixed in Apache Thrift 0.10.0.


Haraka version 2.8.8 and earlier comes with a plugin for processing attachments for zip files. Versions 2.8.8 and earlier can be vulnerable to command injection.


Ruckus Wireless H500 web management interface authenticated command injection


SQL injection vulnerability in articles\\articles_funcs.php in phpCOIN 1.2.2 allows remote attackers to modify SQL syntax and possibly execute SQL in limited circumstances via the rec_next parameter. NOTE: the original disclosure suggests that command injection is not feasible because the injection occurs after an \ORDER BY\ clause but it is likely that this bug could result in an error message path disclosure due to a syntax error in some environments. Therefore this is an exposure and should be included in CVE.


The Net::Ping::External extension through 0.15 for Perl does not properly sanitize arguments (e.g. invalid hostnames) containing shell metacharacters before use of backticks in External.pm allowing for shell command injection and arbitrary command execution if untrusted input is used.


Adobe Digital Editions versions 4.5.10 and below have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.


On D-Link DIR-859 A3-1.06 and DIR-850 A1.13 devices /etc/services/DEVICE.TIME.php allows command injection via the $SERVER variable.


On D-Link DIR-823G devices the GoAhead configuration allows /HNAP1 Command Injection via shell metacharacters in the POST data because this data is sent directly to the \system\ library function.


On D-Link DIR-620 devices with a certain customized (by ISP) variant of firmware 1.0.3 1.0.37 1.3.1 1.3.3 1.3.7 1.4.0 and 2.0.22 OS command injection is possible as a result of incorrect processing of the res_buf parameter to index.cgi.


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 15 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 24 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 20 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 11 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 45 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 5 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 34 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 41 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 30 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 1 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 44 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 4 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 35 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 40 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 31 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 14 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 25 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 21 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 10 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 42 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 2 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 33 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 27 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 38 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 16 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 29 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 12 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 23 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 37 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 6 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 19 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 46 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 8 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 13 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 22 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 36 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 7 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 18 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 9 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 43 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 3 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 32 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 26 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 39 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 17 of 46).


Quest DR Series Disk Backup software version before 4.0.3.1 allows command injection (issue 28 of 46).


Linear eMerge E3-Series devices allow Command Injections.


Adobe Experience Manager versions 6.5 6.4 6.3 and 6.2 have a command injection vulnerability. Successful exploitation could lead to arbitrary code execution.


If this command injection vulnerability could allow remote attackers to run arbitrary commands. Roon Labs has already fixed this vulnerability in the following versions: Roon Server 2021-05-18 and later


A improper neutralization of special elements used in an OS command ('OS Command Injection') in Fortinet FortiWLM version 8.6.1 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.


A improper neutralization of special elements used in an os command ('os command injection') in Fortinet FortiWeb version 6.4.1 and below 6.3.15 and below allows attacker to execute unauthorized code or commands via crafted HTTP requests.


Command injection exists in pdf-image v2.0.0 due to an unescaped string parameter.


Command Injection in the Ping Module in the Web Interface on Technicolor TD5336 OI_Fw_v7 devices allows remote attackers to execute arbitrary OS commands as root via shell metacharacters in the pingAddr parameter to mnt_ping.cgi.


Command injection vulnerability in China Mobile An Lianbao WF-1 1.01 via the 'ip' parameter with a POST request to /api/ZRQos/set_online_client.


Command injection vulnerability in Manual Ping Form (Web UI) in Shenzhen Ejoin Information Technology Co. Ltd. ACOM508/ACOM516/ACOM532 609-915-041-100-020 allows a remote attacker to inject arbitrary code via the field.


Command injection vulnerability in EZ-Internet in Synology DiskStation Manager (DSM) before 6.2-23739 allows remote authenticated users to execute arbitrary command via the username parameter.


Command injection vulnerability in EZ-Internet in Synology Router Manager (SRM) before 1.1.6-6931 allows remote authenticated users to execute arbitrary command via the username parameter.


Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10 3.8 3.6 3.4 allows remote authenticated users to execute a command of their choice via a crafted HTTP request parameter.


Command Injection vulnerability in the web interface in McAfee Advanced Threat Defense (ATD) 3.10 3.8 3.6 3.4 allows remote unauthenticated users / remote attackers to execute a command of their choice via a crafted HTTP request parameter.


Command injection vulnerability in ftpd in Synology Router Manager (SRM) before 1.1.7-6941-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.


Command injection vulnerability in ftpd in Synology Diskstation Manager (DSM) before 6.2-23739-1 allows remote authenticated users to execute arbitrary OS commands via the (1) MKD or (2) RMD command.


Command injection vulnerability in Music Station 5.1.2 and earlier versions in QNAP QTS 4.3.3 and 4.3.4 could allow remote attackers to run arbitrary commands in the compromised application.


Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.


Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.


Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.


Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to run arbitrary commands.