← Back
CWE-77

3,801 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

JSON object

Loading...

CVEs (3,801)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-46230
1Dlink
1Di 7200gv2 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function upgrade_filter. This vulnerability allows attackers to execute arbitrary commands via the path and time...Show more
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function upgrade_filter. This vulnerability allows attackers to execute arbitrary commands via the path and time parameters.Show less
CVE-2021-46229
1Dlink
1Di 7200gv2 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function usb_paswd.asp. This vulnerability allows attackers to execute arbitrary commands via the name parameter.
CVE-2021-46228
1Dlink
1Di 7200gv2 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function httpd_debug.asp. This vulnerability allows attackers to execute arbitrary commands via the time paramete...Show more
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function httpd_debug.asp. This vulnerability allows attackers to execute arbitrary commands via the time parameter.Show less
CVE-2021-46227
1Dlink
1Di 7200gv2 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function proxy_client.asp. This vulnerability allows attackers to execute arbitrary commands via the proxy_srv, p...Show more
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function proxy_client.asp. This vulnerability allows attackers to execute arbitrary commands via the proxy_srv, proxy_srvport, proxy_lanip, proxy_lanport parameters.Show less
CVE-2021-46226
1Dlink
1Di 7200gv2 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
D-Link device DI-7200GV2.E1 v21.04.09E1 was discovered to contain a command injection vulnerability in the function wget_test.asp. This vulnerability allows attackers to execute arbitrary commands via the url parameter.
CVE-2021-45998
1Dlink
1Dir 882 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the LocalIPAddress parameter. This vulnerability allows attackers to execute arbitrary commands via a craft...Show more
D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the LocalIPAddress parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.Show less
CVE-2021-45990
1Tendacn
2G1 Firmware
G3 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function uploadPicture. This vulnerability allows attackers to execute arbitrary commands via the pic_name...Show more
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function uploadPicture. This vulnerability allows attackers to execute arbitrary commands via the pic_name parameter.Show less
CVE-2021-45742
1Totolink
1A720r Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
TOTOLINK A720R v4.1.5cu.470_B20200911 was discovered to contain a command injection vulnerability in the "Main" function. This vulnerability allows attackers to execute arbitrary commands via the QUERY_STRING parameter.
CVE-2021-45738
1Totolink
1X5000r Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter F...Show more
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function UploadFirmwareFile. This vulnerability allows attackers to execute arbitrary commands via the parameter FileName.Show less
CVE-2021-45733
1Totolink
1X5000r Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the parameter host...Show more
TOTOLINK X5000R v9.1.0u.6118_B20201102 was discovered to contain a command injection vulnerability in the function NTPSyncWithHost. This vulnerability allows attackers to execute arbitrary commands via the parameter host_time.Show less
CVE-2021-44882
1Dlink
1Dir 878 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
D-Link device DIR_878_FW1.30B08_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST r...Show more
D-Link device DIR_878_FW1.30B08_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.Show less
CVE-2021-44881
1Dlink
1Dir 882 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP...Show more
D-Link device DIR_882 DIR_882_FW1.30B06_Hotfix_02 was discovered to contain a command injection vulnerability in the twsystem function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.Show less
CVE-2021-44880
1Dlink
2Dir 878 Firmware
Dir 882 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
D-Link devices DIR_878 DIR_878_FW1.30B08_Hotfix_02 and DIR_882 DIR_882_FW1.30B06_Hotfix_02 were discovered to contain a command injection vulnerability in the system function. This vulnerability allows attackers to execu...Show more
D-Link devices DIR_878 DIR_878_FW1.30B08_Hotfix_02 and DIR_882 DIR_882_FW1.30B06_Hotfix_02 were discovered to contain a command injection vulnerability in the system function. This vulnerability allows attackers to execute arbitrary commands via a crafted HNAP1 POST request.Show less
CVE-2021-44247
1Totolink
3A3100r Firmware
A720r FirmwareA830r Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injection vulnerability in the function setNoticeCfg. This vulnerability al...Show more
Totolink devices A3100R v4.1.2cu.5050_B20200504, A830R v5.9c.4729_B20191112, and A720R v4.1.5cu.470_B20200911 were discovered to contain command injection vulnerability in the function setNoticeCfg. This vulnerability allows attackers to execute arbitrary commands via the IpFrom parameter.Show less
CVE-2021-42638
1Printerlogic
1Web Stack
Jul 9, 2026
Feb 1, 2022
N/A· v4
8.1 HIGH· v3
9.3 HIGH· v2
PrinterLogic Web Stack versions 19.1.1.13 SP9 and below do not sanitize user input resulting in pre-auth remote code execution.
CVE-2021-32849
1Gerapy
1Gerapy
Jun 17, 2026
Jan 26, 2022
N/A· v4
8.8 HIGH· v3
9.0 HIGH· v2
Gerapy is a distributed crawler management framework. Prior to version 0.9.9, an authenticated user could execute arbitrary commands. This issue is fixed in version 0.9.9. There are no known workarounds.
CVE-2021-46560
1Moxa
1Tn 5900 Firmware
Jun 17, 2026
Jan 26, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
The firmware on Moxa TN-5900 devices through 3.1 allows command injection that could lead to device damage.
CVE-2021-43589
1Dell
3Emc Unity Operating Environment
Emc Unity Xt Operating EnvironmentEmc Unityvsa Operating Environment
Jun 17, 2026
Jan 24, 2022
N/A· v4
6.7 MEDIUM· v3
7.2 HIGH· v2
Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability. A locally authenticated user with high privileges may potentially...Show more
Dell EMC Unity, Dell EMC UnityVSA and Dell EMC Unity XT versions prior to 5.1.2.0.5.007 contain an operating system (OS) command injection Vulnerability. A locally authenticated user with high privileges may potentially exploit this vulnerability, leading to the execution of arbitrary OS commands on the Unity underlying OS, with the privileges of the vulnerable application. Exploitation may lead to an elevation of privilege.Show less
CVE-2021-44735
1Lexmark
118B2236 Firmware
B2338 FirmwareB2442 Firmware+115 more
Jun 17, 2026
Jan 20, 2022
N/A· v4
9.8 CRITICAL· v3
10.0 HIGH· v2
Embedded web server command injection vulnerability in Lexmark devices through 2021-12-07.
CVE-2021-33965
1Chinamobile
1An Lianbao Wf 1 Firmware
Jun 17, 2026
Jan 18, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which receives parameters by POST request, and the parameter mesh_enable and mesh_device have a command injection vulnerability....Show more
China Mobile An Lianbao WF-1 V1.0.1 router provides a web interface /api/ZRMesh/set_ZRMesh which receives parameters by POST request, and the parameter mesh_enable and mesh_device have a command injection vulnerability. An attacker can use the vulnerability to execute remote commands.Show less