← Back
CWE-77

3,974 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

JSON object

Loading...

CVEs (3,974)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2023-41303
1Huawei
2Emui
Harmonyos
Jun 17, 2026
Sep 25, 2023
N/A· v4
7.5 HIGH· v3
N/A· v2
Command injection vulnerability in the distributed file system module. Successful exploitation of this vulnerability may cause variables in the sock structure to be modified.
CVE-2023-41031
1Juplink
1Rx4 1500 Firmware
Jun 17, 2026
Sep 22, 2023
N/A· v4
8.8 HIGH· v3
7.7 HIGH· v2
Command injection in homemng.htm in Juplink RX4-1500 versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows remote authenticated attackers to execute commands via specially crafted requests to the vulnerable endpoint.
CVE-2023-41029
1Juplink
1Rx4 1500 Firmware
Jun 17, 2026
Sep 22, 2023
N/A· v4
8.8 HIGH· v3
7.7 HIGH· v2
Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows authenticated remote attackers to execute commands as root via speci...Show more
Command injection vulnerability in the homemng.htm endpoint in Juplink RX4-1500 Wifi router firmware versions V1.0.2, V1.0.3, V1.0.4, and V1.0.5 allows authenticated remote attackers to execute commands as root via specially crafted HTTP requests to the vulnerable endpoint.Show less
CVE-2023-43128
1Dlink
1Dir 806 Firmware
Jun 17, 2026
Sep 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
D-LINK DIR-806 1200M11AC wireless router DIR806A1_FW100CNb11 is vulnerable to command injection due to lax filtering of HTTP_ST parameters.
CVE-2023-42810
1Systeminformation
1Systeminformation
Jun 17, 2026
Sep 21, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, c...Show more
systeminformation is a System Information Library for Node.JS. Versions 5.0.0 through 5.21.6 have a SSID Command Injection Vulnerability. The problem was fixed with a parameter check in version 5.21.7. As a workaround, check or sanitize parameter strings that are passed to `wifiConnections()`, `wifiNetworks()` (string only).Show less
CVE-2023-43138
1Tp Link
1Tl Er5120g Firmware
Jun 17, 2026
Sep 20, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds NAPT rules after authentication, and the rule name has an injection point.
CVE-2023-43137
1Tp Link
1Tl Er5120g Firmware
Jun 17, 2026
Sep 20, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
TPLINK TL-ER5120G 4.0 2.0.0 Build 210817 Rel.80868n has a command injection vulnerability, when an attacker adds ACL rules after authentication, and the rule name parameter has injection points.
CVE-2023-43207
1Dlink
1Dwl 6610ap Firmware
Jun 17, 2026
Sep 20, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vulnerability allows attackers to execute arbitrary commands via the configRestore...Show more
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function config_upload_handler. This vulnerability allows attackers to execute arbitrary commands via the configRestore parameter.Show less
CVE-2023-43206
1Dlink
1Dwl 6610ap Firmware
Jun 17, 2026
Sep 20, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerability allows attackers to execute arbitrary commands via the certDownl...Show more
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function web_cert_download_handler. This vulnerability allows attackers to execute arbitrary commands via the certDownload parameter.Show less
CVE-2023-43204
1Dlink
1Dwl 6610ap Firmware
Jun 17, 2026
Sep 20, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parame...Show more
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function sub_2EF50. This vulnerability allows attackers to execute arbitrary commands via the manual-time-string parameter.Show less
CVE-2023-43202
1Dlink
1Dwl 6610ap Firmware
Jun 17, 2026
Sep 20, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerability allows attackers to execute arbitrary commands via the update.device...Show more
D-LINK DWL-6610 FW_v_4.3.0.8B003C was discovered to contain a command injection vulnerability in the function pcap_download_handler. This vulnerability allows attackers to execute arbitrary commands via the update.device.packet-capture.tftp-file-name parameter.Show less
CVE-2023-43477
1Telstra
1Arcadyan Lh1000 Firmware
Jun 17, 2026
Sep 20, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanitized before being used in a system call, which could allow an...Show more
The ping_from parameter of ping_tracerte.cgi in the web UI of Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, was not properly sanitized before being used in a system call, which could allow an authenticated attacker to achieve command injection as root on the device. Show less
CVE-2023-33831
1Frangoteam
1Fuxa
Jun 17, 2026
Sep 18, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
A remote command execution (RCE) vulnerability in the /api/runscript endpoint of FUXA 1.1.13 allows attackers to execute arbitrary commands via a crafted POST request.
CVE-2023-34999
1Bosch
1Rts Vlink Virtual Matrix
Jun 17, 2026
Sep 18, 2023
N/A· v4
7.2 HIGH· v3
N/A· v2
A command injection vulnerability exists in RTS VLink Virtual Matrix Software Versions v5 (< 5.7.6) and v6 (< 6.5.0) that allows an attacker to perform arbitrary code execution via the admin web interface.
CVE-2023-39638
1Dlink
1Dir 859 A1 Firmware
Jun 17, 2026
Sep 14, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
D-LINK DIR-859 A1 1.05 and A1 1.06B01 Beta01 was discovered to contain a command injection vulnerability via the lxmldbc_system function at /htdocs/cgibin.
CVE-2023-41011
1Chinamobile
1Intelligent Home Gateway Firmware
Jun 17, 2026
Sep 14, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Command Execution vulnerability in China Mobile Communications China Mobile Intelligent Home Gateway v.HG6543C4 allows a remote attacker to execute arbitrary code via the shortcut_telnet.cg component.
CVE-2023-36642
1Fortinet
1Fortitester
Jun 17, 2026
Sep 13, 2023
N/A· v4
7.8 HIGH· v3
N/A· v2
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized comma...Show more
An improper neutralization of special elements used in an OS command vulnerability [CWE-78] in the management interface of FortiTester 3.0.0 through 7.2.3 may allow an authenticated attacker to execute unauthorized commands via specifically crafted arguments to existing commands.Show less
CVE-2023-3710
1Honeywell
1Pm43 Firmware
Jun 17, 2026
Sep 12, 2023
N/A· v4
9.8 CRITICAL· v3
N/A· v2
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmwar...Show more
Improper Input Validation vulnerability in Honeywell PM43 on 32 bit, ARM (Printer web page modules) allows Command Injection.This issue affects PM43 versions prior to P10.19.050004. Update to the latest available firmware version of the respective printers to version MR19.5 (e.g. P10.19.050006).Show less
CVE-2023-36805
1Microsoft
11Windows 10 1507
Windows 10 1607Windows 10 1809+8 more
Jun 17, 2026
Sep 12, 2023
N/A· v4
7.0 HIGH· v3
N/A· v2
Windows MSHTML Platform Security Feature Bypass Vulnerability
CVE-2023-33136
1Microsoft
1Azure Devops Server
Jun 17, 2026
Sep 12, 2023
N/A· v4
8.8 HIGH· v3
N/A· v2
Azure DevOps Server Remote Code Execution Vulnerability