CWE-78— OS Command Injection

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.— MITRE CWE catalog

6,275 active CVEs classified under this weakness category. Sourced from NVD, GHSA, and vendor advisories. Full definition on MITRE →

CVEs classified under CWE-78page 69 of 126

CVE-2023-40069CRITICALCVSS 9.8EG 9.8
2023-08-18
OS command injection vulnerability in ELECOM wireless LAN routers allows an attacker who can access the product to execute an arbitrary OS command by sending a specially crafted request. Affected products and versions are as follows: WRC-F…
CVE-2023-40072HIGHCVSS 8.8EG 8.8
2023-08-18
OS command injection vulnerability in ELECOM wireless LAN access point devices allows an authenticated user to execute an arbitrary OS command by sending a specially crafted request.
CVE-2023-40144HIGHCVSS 8.8EG 8.8
2023-08-23
OS command injection vulnerability in the CBC products allows a remote authenticated attacker to execute an arbitrary OS command on the device or alter its settings. As for the affected products/versions, see the detailed information provi…
CVE-2023-40145HIGHCVSS 8.8EG 8.8
2023-10-19
In Weintek's cMT3000 HMI Web CGI device, an anonymous attacker can execute arbitrary commands after login to the device.
CVE-2023-40193HIGHCVSS 8.0EG 8.0
2023-09-06
Deco M4 firmware versions prior to 'Deco M4(JP)_V2_1.5.8 Build 20230619' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
CVE-2023-40253MEDIUMCVSS 6.0EG 6.0
2023-08-11
Improper Authentication vulnerability in Genians Genian NAC V4.0, Genians Genian NAC V5.0, Genians Genian NAC Suite V5.0, Genians Genian ZTNA allows Authentication Abuse.This issue affects Genian NAC V4.0: from V4.0.0 through V4.0.155; Gen…
CVE-2023-4033HIGHCVSS 7.8EG 7.8
2023-08-01
OS Command Injection in GitHub repository mlflow/mlflow prior to 2.6.0.
CVE-2023-40357HIGHCVSS 8.0EG 8.0
2023-09-06
Multiple TP-LINK products allow a network-adjacent authenticated attacker to execute arbitrary OS commands. Affected products/versions are as follows: Archer AX50 firmware versions prior to 'Archer AX50(JP)_V1_230529', Archer A10 firmware …
CVE-2023-40479HIGHCVSS 8.8EG 8.8
2024-05-03
NETGEAR RAX30 UPnP Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not required to …
CVE-2023-40480HIGHCVSS 8.8EG 8.8
2024-05-03
NETGEAR RAX30 DHCP Server Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR RAX30 routers. Authentication is not requi…
CVE-2023-40504CRITICALCVSS 9.8EG 9.8
2024-05-03
LG Simple Editor readVideoInfo Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not required to exp…
CVE-2023-40505CRITICALCVSS 9.8EG 9.8
2024-05-03
LG Simple Editor createThumbnailByMovie Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of LG Simple Editor. Authentication is not requir…
CVE-2023-40531HIGHCVSS 8.0EG 8.0
2023-09-06
Archer AX6000 firmware versions prior to 'Archer AX6000(JP)_V1_1.3.0 Build 20221208' allows a network-adjacent authenticated attacker to execute arbitrary OS commands.
CVE-2023-40581HIGHCVSS 8.3EG 8.3
2023-09-25
yt-dlp is a youtube-dl fork with additional features and fixes. yt-dlp allows the user to provide shell command lines to be executed at various stages in its download steps through the `--exec` flag. This flag allows output template expans…
CVE-2023-40582CRITICALCVSS 9.8EG 9.8
2023-08-30
find-exec is a utility to discover available shell commands. Versions prior to 1.0.3 did not properly escape user input and are vulnerable to Command Injection via an attacker controlled parameter. As a result, attackers may run malicious …
CVE-2023-40716MEDIUMCVSS 6.7EG 6.7
2023-12-13
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the command line interpreter of FortiTester 2.3.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via speci…
CVE-2023-40837CRITICALCVSS 9.8EG 9.8
2023-08-30
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADD50' contains a command execution vulnerability. In the "formSetIptv" function, obtaining the "list" and "vlanId" fields, unfiltered passing these two fields as parameters …
CVE-2023-40838CRITICALCVSS 9.8EG 9.8
2023-08-30
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_3A1D0' contains a command execution vulnerability.
CVE-2023-40839CRITICALCVSS 9.8EG 9.8
2023-08-30
Tenda AC6 US_AC6V1.0BR_V15.03.05.16_multi_TD01.bin function 'sub_ADF3C' contains a command execution vulnerability. In the "formSetIptv" function, obtaining the "list" and "vlanId" fields, unfiltered passing these two fields as parameters …
CVE-2023-41109CRITICALCVSS 9.8EG 9.8
2023-08-28
SmartNode SN200 (aka SN200) 3.21.2-23021 allows unauthenticated OS Command Injection.
CVE-2023-41149CRITICALCVSS 9.8EG 9.8
2023-09-06
F-RevoCRM version7.3.7 and version7.3.8 contains an OS command injection vulnerability. If this vulnerability is exploited, an attacker who can access the product may execute an arbitrary OS command on the server where the product is runni…
CVE-2023-41188HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetAPLanSettings DeviceName Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Au…
CVE-2023-41189HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetAPLanSettings Gateway Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authe…
CVE-2023-41190HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetAPLanSettings IPAddr Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authen…
CVE-2023-41191HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetAPLanSettings Mode Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authenti…
CVE-2023-41192HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetAPLanSettings PrimaryDNS Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Au…
CVE-2023-41193HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetAPLanSettings SecondaryDNS Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. …
CVE-2023-41194HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetAPLanSettings SubnetMask Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Au…
CVE-2023-41195HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetHostIPv6Settings IPv6Mode Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. A…
CVE-2023-41196HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticAddress Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325…
CVE-2023-41197HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticDefaultGateway Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link D…
CVE-2023-41198HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticDNS1 Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 ro…
CVE-2023-41199HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticDNS2 Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 ro…
CVE-2023-41200HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetHostIPv6StaticSettings StaticPrefixLength Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP…
CVE-2023-41201HIGHCVSS 8.8EG 8.8
2024-05-03
D-Link DAP-1325 HNAP SetSetupWizardStatus Enabled Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. A…
CVE-2023-41281MEDIUMCVSS 5.5EG 5.5
2024-02-02
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed th…
CVE-2023-41282MEDIUMCVSS 5.5EG 5.5
2024-02-02
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed th…
CVE-2023-41283MEDIUMCVSS 5.5EG 5.5
2024-02-02
An OS command injection vulnerability has been reported to affect several QNAP operating system versions. If exploited, the vulnerability could allow authenticated administrators to execute commands via a network. We have already fixed th…
CVE-2023-41288HIGHCVSS 8.8EG 8.8
2024-01-05
An OS command injection vulnerability has been reported to affect Video Station. If exploited, the vulnerability could allow users to execute commands via a network. We have already fixed the vulnerability in the following version: Video …
CVE-2023-41289HIGHCVSS 8.8EG 8.8
2024-01-05
An OS command injection vulnerability has been reported to affect QcalAgent. If exploited, the vulnerability could allow authenticated users to execute commands via a network. We have already fixed the vulnerability in the following versi…
CVE-2023-41345HIGHCVSS 8.8EG 8.8
2023-11-03
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-generated module. An authenticated remote attacker can exploit this vulnerability to perform a Command In…
CVE-2023-41346HIGHCVSS 8.8EG 8.8
2023-11-03
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its token-refresh module. An authenticated remote attacker can exploit this vulnerability to perform a Command Inje…
CVE-2023-41347HIGHCVSS 8.8EG 8.8
2023-11-03
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its check token module. An authenticated remote attacker can exploit this vulnerability to perform a Command Inject…
CVE-2023-41348HIGHCVSS 8.8EG 8.8
2023-11-03
ASUS RT-AX55’s authentication-related function has a vulnerability of insufficient filtering of special characters within its code-authentication module. An authenticated remote attacker can exploit this vulnerability to perform a Comman…
CVE-2023-41352HIGHCVSS 7.2EG 7.2
2023-11-03
Chunghwa Telecom NOKIA G-040W-Q has a vulnerability of insufficient filtering for user input. A remote attacker with administrator privilege can exploit this vulnerability to perform a Command Injection attack to execute arbitrary commands…
CVE-2023-4149CRITICALCVSS 9.8EG 9.8
2023-11-21
A vulnerability in the web-based management allows an unauthenticated remote attacker to inject arbitrary system commands and gain full system control. Those commands are executed with root privileges. The vulnerability is located in the u…
CVE-2023-41738HIGHCVSS 8.8EG 8.8
2023-08-31
Improper neutralization of special elements used in an OS command ('OS Command Injection') vulnerability in Directory Domain Functionality in Synology Router Manager (SRM) before 1.3.1-9346-6 allows remote authenticated users to execute ar…
CVE-2023-41838HIGHCVSS 7.1EG 7.1
2023-10-10
An improper neutralization of special elements used in an os command ('os command injection') in FortiManager 7.4.0 and 7.2.0 through 7.2.3 may allow attacker to execute unauthorized code or commands via FortiManager cli.
CVE-2023-42120HIGHCVSS 8.8EG 8.8
2024-05-03
Control Web Panel dns_zone_editor Command Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Control Web Panel. Authentication is required to exp…
CVE-2023-42122HIGHCVSS 7.8EG 7.8
2024-05-03
Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the abilit…

Map vulnerabilities like CWE-78 to your infrastructure

EchelonGraph correlates every CVE — across CWE-78 and 150+ other weakness categories — against the assets you actually run. See blast radius, fix versions, and remediation steps in one graph.

Start Free Scan →