CWE-77
3,974 CVEs • Abstraction: Class • Likelihood of Exploit: High
Improper Neutralization of Special Elements used in a Command ('Command Injection')
The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.
CVEs (3,974)
CVE VENDORS PRODUCTS UPDATED PUBLISHED CVSS |
|---|
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /cgi-bin/uploadWeiXinPic. |
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/delAd. |
Tenda M3 1.10 V1.0.0.12(4856) was discovered to contain a command injection vulnerability via the component /goform/setFixTools. |
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the langType parameter in the login interface. |
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via /setting/NTPSyncWithHost. |
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the pingCheck function. |
TOTOLINK N600R V4.3.0cu.7570_B20200620 was discovered to contain a command injection vulnerability via the exportOvpn interface at cstecgi.cgi. |
1Garo 3Wallbox Glb Firmware Wallbox Gtb FirmwareWallbox Gtc FirmwareJun 17, 2026 Mar 21, 2022 N/A· v4 9.8 CRITICAL· v3 7.5 HIGH· v2 Multiple versions of GARO Wallbox GLB/GTB/GTC are affected by unauthenticated command injection. The url parameter of the function module downloadAndUpdate is vulnerable to an command Injection. Unfiltered user input is...Show more |
1Commscope 1Arris Tr3300 Firmware Jun 17, 2026 Mar 15, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the ddns function via the ddns_name, ddns_pwd, h_ddns、ddns_host parameters. This vulnerability allows attackers to execute arbitrary co...Show more |
1Commscope 1Arris Tr3300 Firmware Jun 17, 2026 Mar 15, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Arris TR3300 v1.0.13 were discovered to contain a command injection vulnerability in the dhcp function via the hostname parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. |
1Commscope 1Arris Tr3300 Firmware Jun 17, 2026 Mar 15, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the time and time zone function via the h_primary_ntp_server, h_backup_ntp_server, and h_time_zone parameters. This vulnerability allows...Show more |
1Commscope 1Arris Tr3300 Firmware Jun 17, 2026 Mar 15, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the static ip settings function via the wan_ip_stat, wan_mask_stat, wan_gw_stat, and wan_dns1_stat parameters. This vulnerability allows...Show more |
1Commscope 1Arris Tr3300 Firmware Jun 17, 2026 Mar 15, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the wps setting function via the wps_enrolee_pin parameter. This vulnerability allows attackers to execute arbitrary commands via a craf...Show more |
1Commscope 1Arris Tr3300 Firmware Jun 17, 2026 Mar 15, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the upnp function via the upnp_ttl parameter. This vulnerability allows attackers to execute arbitrary commands via a crafted request. |
1Commscope 1Arris Tr3300 Firmware Jun 17, 2026 Mar 15, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pppoe function via the pppoe_username, pppoe_passwd, and pppoe_servicename parameters. This vulnerability allows attackers to execut...Show more |
1Commscope 1Arris Tr3300 Firmware Jun 17, 2026 Mar 15, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 Arris TR3300 v1.0.13 was discovered to contain a command injection vulnerability in the pptp (wan_pptp.html) function via the pptp_fix_ip, pptp_fix_mask, pptp_fix_gw, and wan_dns1_stat parameters. This vulnerability allo...Show more |
A Command Injection vulnerability exits in TOTOLINK A3100R <=V4.1.2cu.5050_B20200504 in adm/ntm.asp via the hosTime parameters. |
1Tp Link 1Tapo C200 Firmware Jun 17, 2026 Mar 10, 2022 N/A· v4 9.8 CRITICAL· v3 10.0 HIGH· v2 TP-Link Tapo C200 IP camera, on its 1.1.15 firmware version and below, is affected by an unauthenticated RCE vulnerability, present in the uhttpd binary running by default as root. The exploitation of this vulnerability...Show more |
An authenticated remote code execution vulnerability was discovered in the AOS-CX Network Analytics Engine (NAE) in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Seri...Show more |
Multiple authenticated remote code execution vulnerabilities were discovered in the AOS-CX command line interface in Aruba CX 6200F Switch Series, Aruba 6300 Switch Series, Aruba 6400 Switch Series, Aruba 8320 Switch Ser...Show more |