← Back
CWE-78

6,732 CVEs • Abstraction: Base • Likelihood of Exploit: High

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

JSON object

Loading...

CVEs (6,732)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2024-52019
1Netgear
1R8500 Firmware
Jun 17, 2026
Nov 5, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted requ...Show more
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.Show less
CVE-2024-52018
1Netgear
1Xr300 Firmware
Jun 17, 2026
Nov 5, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at genie_dyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted reques...Show more
Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at genie_dyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.Show less
CVE-2024-51024
1Dlink
1Dir 823g Firmware
Jun 17, 2026
Nov 5, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
D-Link DIR_823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a c...Show more
D-Link DIR_823G 1.0.2B05 was discovered to contain a command injection vulnerability via the HostName parameter in the SetWanSettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.Show less
CVE-2024-51023
1Dlink
1Dir 823g Firmware
Jun 17, 2026
Nov 5, 2024
N/A· v4
8.8 HIGH· v3
N/A· v2
D-Link DIR_823G 1.0.2B05 was discovered to contain a command injection vulnerability via the Address parameter in the SetNetworkTomographySettings function. This vulnerability allows attackers to execute arbitrary OS com...Show more
D-Link DIR_823G 1.0.2B05 was discovered to contain a command injection vulnerability via the Address parameter in the SetNetworkTomographySettings function. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.Show less
CVE-2024-51021
1Netgear
3R6400v2 Firmware
R7000p FirmwareXr300 Firmware
Jun 17, 2026
Nov 5, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a command injection vulnerability via the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execu...Show more
Netgear XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 was discovered to contain a command injection vulnerability via the wan_gateway parameter at genie_fix2.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.Show less
CVE-2024-51010
1Netgear
4R6400v2 Firmware
R7000p FirmwareR8500 Firmware+1 more
Jun 17, 2026
Nov 5, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component ap_mode.cgi via the apmode_gateway parameter. This vulner...Show more
Netgear R8500 v1.0.2.160, XR300 v1.0.3.78, R7000P v1.3.3.154, and R6400 v2 1.0.4.128 were discovered to contain a command injection vulnerability in the component ap_mode.cgi via the apmode_gateway parameter. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.Show less
CVE-2024-51009
1Netgear
1R8500 Firmware
Jun 17, 2026
Nov 5, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the wan_gateway parameter at ether.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVE-2024-51008
1Netgear
1Xr300 Firmware
Jun 17, 2026
Nov 5, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
Netgear XR300 v1.0.3.78 was discovered to contain a command injection vulnerability in the system_name parameter at wiz_dyn.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.
CVE-2024-51005
1Netgear
1R8500 Firmware
Jun 17, 2026
Nov 5, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a craf...Show more
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the share_name parameter at usb_remote_smb_conf.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.Show less
CVE-2024-50993
1Netgear
1R8500 Firmware
Jun 17, 2026
Nov 5, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at admin_account.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted...Show more
Netgear R8500 v1.0.2.160 was discovered to contain a command injection vulnerability in the sysNewPasswd parameter at admin_account.cgi. This vulnerability allows attackers to execute arbitrary OS commands via a crafted request.Show less
CVE-2024-45893
1Draytek
1Vigor3900 Firmware
Jun 17, 2026
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMOption.`
CVE-2024-45891
1Draytek
1Vigor3900 Firmware
Jun 17, 2026
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_wlan_profile.`
CVE-2024-45890
1Draytek
1Vigor3900 Firmware
Jun 17, 2026
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `download_ovpn.`
CVE-2024-45889
1Draytek
1Vigor3900 Firmware
Jun 17, 2026
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `commandTable.`
CVE-2024-45888
1Draytek
1Vigor3900 Firmware
Jun 17, 2026
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `set_ap_map_config.'
CVE-2024-45887
1Draytek
1Vigor3900 Firmware
Jun 17, 2026
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `doOpenVPN.`
CVE-2024-45885
1Draytek
1Vigor3900 Firmware
Jun 17, 2026
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `autodiscovery_clear.`
CVE-2024-45884
1Draytek
1Vigor3900 Firmware
Jun 17, 2026
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 contains a post-authentication command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `setSWMGroup.`
CVE-2024-45882
1Draytek
1Vigor3900 Firmware
Jun 17, 2026
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
DrayTek Vigor3900 1.5.1.3 contains a command injection vulnerability. This vulnerability occurs when the `action` parameter in `cgi-bin/mainfunction.cgi` is set to `delete_map_profile.`
CVE-2024-51253
1Draytek
1Vigor3900 Firmware
Jun 17, 2026
Nov 4, 2024
N/A· v4
8.0 HIGH· v3
N/A· v2
In Draytek Vigor3900 1.5.1.3, attackers can inject malicious commands into mainfunction.cgi and execute arbitrary commands by calling the doL2TP function.