← Back
CWE-77

3,974 CVEs • Abstraction: Class • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in a Command ('Command Injection')

The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

JSON object

Loading...

CVEs (3,974)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2021-44132
1C Data Onu4ferw Project
1C Data Onu4ferw Firmware
Jun 17, 2026
Feb 25, 2022
N/A· v4
7.8 HIGH· v3
6.8 MEDIUM· v2
A command injection vulnerability in the function formImportOMCIShell of C-DATA ONU4FERW V2.1.13_X139 allows attackers to execute arbitrary commands via a crafted file.
CVE-2021-40043
1Huawei
1Ais Bw80h 00 Firmware
Jun 17, 2026
Feb 25, 2022
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00). The devices cannot effectively defend against external malicious interference. Attackers need the...Show more
The laser command injection vulnerability exists on AIS-BW80H-00 versions earlier than AIS-BW80H-00 9.0.3.4(H100SP13C00). The devices cannot effectively defend against external malicious interference. Attackers need the device to be visually exploitable and successful triggering of this vulnerability could execute voice commands on the device.Show less
CVE-2021-39363
1Honeywell
2Hbw2per1 Firmware
Hdzp252di Firmware
Jun 17, 2026
Feb 24, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Honeywell HDZP252DI 1.00.HW02.4 and HBW2PER1 1.000.HW01.3 devices allow a video replay attack after ARP cache poisoning has been achieved.
CVE-2022-25137
1Totolink
2T10 Firmware
T6 Firmware
Jun 17, 2026
Feb 19, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbi...Show more
A command injection vulnerability in the function recvSlaveUpgstatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.Show less
CVE-2022-25136
1Totolink
2T10 Firmware
T6 Firmware
Jun 17, 2026
Feb 19, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitra...Show more
A command injection vulnerability in the function meshSlaveUpdate of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.Show less
CVE-2022-25135
1Totolink
1T6 Firmware
Jun 17, 2026
Feb 19, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A command injection vulnerability in the function recv_mesh_info_sync of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2022-25134
1Totolink
1T6 Firmware
Jun 17, 2026
Feb 19, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A command injection vulnerability in the function setUpgradeFW of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2022-25133
1Totolink
1T6 Firmware
Jun 17, 2026
Feb 19, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A command injection vulnerability in the function isAssocPriDevice of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2022-25132
1Totolink
2T10 Firmware
T6 Firmware
Jun 17, 2026
Feb 19, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A command injection vulnerability in the function meshSlaveDlfw of TOTOLINK Technology router T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 allows attackers to execute arbitrary commands via a crafted MQTT packet.
CVE-2022-25131
1Totolink
2T10 Firmware
T6 Firmware
Jun 17, 2026
Feb 19, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execu...Show more
A command injection vulnerability in the function recvSlaveCloudCheckStatus of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.Show less
CVE-2022-25130
1Totolink
2T10 Firmware
T6 Firmware
Jun 17, 2026
Feb 19, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrar...Show more
A command injection vulnerability in the function updateWifiInfo of TOTOLINK Technology routers T6 V3_Firmware T6_V3_V4.1.5cu.748_B20211015 and T10 V2_Firmware V4.1.8cu.5207_B20210320 allows attackers to execute arbitrary commands via a crafted MQTT packet.Show less
CVE-2021-45082
4Cobbler Project
FedoraprojectOpensuse+1 more
5Backports
CobblerFactory+2 more
Jun 17, 2026
Feb 19, 2022
N/A· v4
7.8 HIGH· v3
4.6 MEDIUM· v2
An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginni...Show more
An issue was discovered in Cobbler before 3.3.1. In the templar.py file, the function check_for_invalid_imports can allow Cheetah code to import Python modules via the "#from MODULE import" substring. (Only lines beginning with #import are blocked.)Show less
CVE-2021-45401
1Tendacn
1Ac10u Firmware
Jun 17, 2026
Feb 18, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functionality. The vulnerability is caused because the client con...Show more
A Command injection vulnerability exists in Tenda AC10U AC1200 Smart Dual-band Wireless Router AC10U V1.0 Firmware V15.03.06.49_multi via the setUsbUnload functionality. The vulnerability is caused because the client controlled "deviceName" value is passed directly to the "doSystemCmd" function.Show less
CVE-2021-41599
1Github
1Enterprise Server
Jun 17, 2026
Feb 18, 2022
N/A· v4
8.8 HIGH· v3
6.5 MEDIUM· v2
A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and b...Show more
A remote code execution vulnerability was identified in GitHub Enterprise Server that could be exploited when building a GitHub Pages site. To exploit this vulnerability, an attacker would need permission to create and build a GitHub Pages site on the GitHub Enterprise Server instance. This vulnerability affected all versions of GitHub Enterprise Server prior to 3.3 and was fixed in versions 3.0.21, 3.1.13, 3.2.5. This vulnerability was reported via the GitHub Bug Bounty program.Show less
CVE-2021-41552
1Commscope
5Arris Surfboard Sbg10 Firmware
Arris Surfboard Sbg6950ac2 FirmwareArris Surfboard Sbg7400ac2 Firmware+2 more
Jun 17, 2026
Feb 15, 2022
N/A· v4
8.8 HIGH· v3
5.8 MEDIUM· v2
CommScope SURFboard SBG6950AC2 9.1.103AA23 devices allow Command Injection.
CVE-2019-16864
1Enterprisedt
1Completeftp Server
Jun 17, 2026
Feb 14, 2022
N/A· v4
8.8 HIGH· v3
8.5 HIGH· v2
CompleteFTPService.exe in the server in EnterpriseDT CompleteFTP before 12.1.4 allows Remote Code Execution by leveraging a Windows user account that has SSH access. The exec command is always run as SYSTEM.
CVE-2022-24171
1Tendacn
2G1 Firmware
G3 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerability allows attackers to execute arbitrary commands via the pppo...Show more
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetPppoeServer. This vulnerability allows attackers to execute arbitrary commands via the pppoeServerIP, pppoeServerStartIP, and pppoeServerEndIP parameters.Show less
CVE-2022-24170
1Tendacn
2G1 Firmware
G3 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerability allows attackers to execute arbitrary commands via the IPse...Show more
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpSecTunnel. This vulnerability allows attackers to execute arbitrary commands via the IPsecLocalNet and IPsecRemoteNet parameters.Show less
CVE-2022-24168
1Tendacn
2G1 Firmware
G3 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability allows attackers to execute arbitrary commands via the IPGroupS...Show more
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability allows attackers to execute arbitrary commands via the IPGroupStartIP and IPGroupEndIP parameters.Show less
CVE-2022-24167
1Tendacn
2G1 Firmware
G3 Firmware
Jun 17, 2026
Feb 4, 2022
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows attackers to execute arbitrary commands via the dmzHost1 par...Show more
Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows attackers to execute arbitrary commands via the dmzHost1 parameter.Show less