CVE-2018-19950 | ByteOS Network

Vulnerability Details :

CVE-2018-19950

Assigner-qnap

Assigner Org ID-2fd009eb-170a-4625-932b-17a53af1051f

Published At-02 Nov, 2020 | 15:57

Updated At-17 Sep, 2024 | 02:31

If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.

EPSS History

Score

Latest Score

-

N/A

Percentile

Latest Percentile

-

N/A

▼Common Vulnerabilities and Exposures (CVE)

Assigner:qnap

Assigner Org ID:2fd009eb-170a-4625-932b-17a53af1051f

Published At:02 Nov, 2020 | 15:57

Updated At:17 Sep, 2024 | 02:31

▼CVE Numbering Authority (CNA)

If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.

Affected Products

Vendor

QNAP Systems, Inc.

Product

Versions

Affected

From unspecified before 5.1.13 (custom)
From unspecified before 5.2.9 (custom)
From unspecified before 5.3.11 (custom)

Problem Types

Type	CWE ID	Description
CWE	CWE-77	CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE	CWE-78	CWE-78 OS Command Injection

Type: CWE

CWE ID: CWE-77

Description: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Type: CWE

CWE ID: CWE-78

Description: CWE-78 OS Command Injection

Solutions

QNAP have already fixed the issue in the following Music Station: QTS 4.3.3: Music Station 5.1.13 and later QTS 4.3.4: Music Station 5.1.13 and later QTS 4.3.6: Music Station 5.2.9 and later QTS 4.4.3: Music Station 5.3.11 and later

Credits

Independent Security Evaluators

References

Hyperlink	Resource
https://www.qnap.com/en/security-advisory/qsa-20-10	x_refsource_MISC

Hyperlink: https://www.qnap.com/en/security-advisory/qsa-20-10

Resource:

x_refsource_MISC

▼Authorized Data Publishers (ADP)

CVE Program Container

References

Hyperlink	Resource
https://www.qnap.com/en/security-advisory/qsa-20-10	x_refsource_MISC x_transferred

Hyperlink: https://www.qnap.com/en/security-advisory/qsa-20-10

Resource:

x_refsource_MISC

x_transferred

▼National Vulnerability Database (NVD)

Source:security@qnapsecurity.com.tw

Published At:02 Nov, 2020 | 16:15

Updated At:16 Nov, 2022 | 15:30

If exploited, this command injection vulnerability could allow remote attackers to execute arbitrary commands. This issue affects: QNAP Systems Inc. Music Station versions prior to 5.1.13; versions prior to 5.2.9; versions prior to 5.3.11.

Metrics

Type	Version	Base score	Base severity	Vector
Primary	3.1	9.8	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary	2.0	7.5	HIGH	AV:N/AC:L/Au:N/C:P/I:P/A:P

Type: Primary

Version: 3.1

Base score: 9.8

Base severity: CRITICAL

Vector:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Type: Primary

Version: 2.0

Base score: 7.5

Base severity: HIGH

Vector:

AV:N/AC:L/Au:N/C:P/I:P/A:P

CPE Matches

QNAP Systems, Inc.

>>qts>>4.4.3

cpe:2.3:o:qnap:qts:4.4.3:*:*:*:*:*:*:*

QNAP Systems, Inc.

>>music_station>>Versions from 5.3.0(inclusive) to 5.3.11(exclusive)

cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>4.3.4

cpe:2.3:o:qnap:qts:4.3.4:*:*:*:*:*:*:*

QNAP Systems, Inc.

>>music_station>>Versions before 5.1.13(exclusive)

cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>4.3.6

cpe:2.3:o:qnap:qts:4.3.6:*:*:*:*:*:*:*

QNAP Systems, Inc.

>>music_station>>Versions from 5.2.0(inclusive) to 5.2.9(exclusive)

cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*

QNAP Systems, Inc.

>>qts>>4.3.3

cpe:2.3:o:qnap:qts:4.3.3:*:*:*:*:*:*:*

QNAP Systems, Inc.

>>music_station>>Versions before 5.1.13(exclusive)

cpe:2.3:a:qnap:music_station:*:*:*:*:*:*:*:*

Weaknesses

CWE ID	Type	Source
CWE-77	Primary	nvd@nist.gov
CWE-77	Secondary	security@qnapsecurity.com.tw
CWE-78	Secondary	security@qnapsecurity.com.tw

CWE ID: CWE-77

Type: Primary

Source: nvd@nist.gov

CWE ID: CWE-77

Type: Secondary

Source: security@qnapsecurity.com.tw

CWE ID: CWE-78

Type: Secondary

Source: security@qnapsecurity.com.tw

References

Hyperlink	Source	Resource
https://www.qnap.com/en/security-advisory/qsa-20-10	security@qnapsecurity.com.tw	Vendor Advisory

Hyperlink: https://www.qnap.com/en/security-advisory/qsa-20-10

Source: security@qnapsecurity.com.tw

Resource:

Vendor Advisory

Similar CVEs

2174Records found

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-4.3||MEDIUM

EPSS-1.24% / 78.39%

||

7 Day CHG~0.00%

Published-06 Aug, 2024 | 00:00

Updated-12 Nov, 2024 | 17:35

GL-iNet products AR750/AR750S/AR300M/AR300M16/MT300N-V2/B1300/MT1300/SFT1200/X750 v4.3.11, MT3000/MT2500/AXT1800/AX1800/A1300/X300B v4.5.16, XE300 v4.3.16, E750 v4.3.12, AP1300/S1300 v4.3.13, and XE3000/X3000 v4.4 were discovered to contain a vulnerability can be exploited to manipulate routers by passing malicious shell commands through the s2s API.

Vendor-gl-inet n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE ID-CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-7.67% / 91.52%

||

7 Day CHG~0.00%

Published-02 Aug, 2024 | 00:00

Updated-20 Aug, 2024 | 16:17

An issue in Horizon Business Services Inc. Caterease 16.0.1.1663 through 24.0.1.2405 and possibly later versions, allows a remote attacker to expand control over the operating system from the database due to the execution of commands with unnecessary privileges.

Vendor-horizoncloud n/a horizoncloud

Product-caterease n/a caterease

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-93.51% / 99.82%

||

7 Day CHG~0.00%

Published-23 Jun, 2023 | 00:00

Updated-29 Aug, 2025 | 15:15

Command Injection vulnerability in MagnusSolution magnusbilling 6.x and 7.x allows remote attackers to run arbitrary commands via unauthenticated HTTP request.

Vendor-magnussolution n/a

Product-magnusbilling n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.54% / 66.48%

||

7 Day CHG~0.00%

Published-06 Apr, 2023 | 00:00

Updated-12 Feb, 2025 | 17:15

inventory in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attacker to run arbitrary commands on the platform operating system and achieve administrative access, aka OSFOURK-23552.

Vendor-atos n/a

Product-unify_openscape_4000_manager unify_openscape_4000 n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.14% / 77.55%

||

7 Day CHG~0.00%

Published-14 Apr, 2023 | 00:00

Updated-06 Feb, 2025 | 21:15

WFS-SR03 v1.0.3 was discovered to contain a command injection vulnerability via the pro_stor_canceltrans_handler_part_19 function.

Vendor-iodata n/a

Product-wfs-sr03w wfs-sr03k wfs-sr03k_firmware wfs-sr03w_firmware n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-4.12% / 88.17%

||

7 Day CHG~0.00%

Published-05 May, 2023 | 00:00

Updated-29 Jan, 2025 | 18:15

TOTOLINK A7100RU V7.4cu.2313_B20191024 has a Command Injection vulnerability. An attacker can obtain a stable root shell through a specially constructed payload.

Vendor-n/a TOTOLINK

Product-a7100ru_firmware a7100ru n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-9.14% / 92.35%

||

7 Day CHG~0.00%

Published-04 Feb, 2022 | 01:33

Updated-03 Aug, 2024 | 04:07

Tenda AX3 v16.03.12.10_CN was discovered to contain a command injection vulnerability in the function mDMZSetCfg. This vulnerability allows attackers to execute arbitrary commands via the dmzIp parameter.

Vendor-n/a Tenda Technology Co., Ltd.

Product-ax3 ax3_firmware n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-Snyk

Matching Score-4

Assigner-Snyk

CVSS Score-8.1||HIGH

EPSS-2.89% / 85.80%

||

7 Day CHG-1.23%

Published-03 Jun, 2022 | 20:00

Updated-17 Sep, 2024 | 00:46

Command Injection

The package cookiecutter before 2.1.1 are vulnerable to Command Injection via hg argument injection. When calling the cookiecutter function from Python code with the checkout parameter, it is passed to the hg checkout command in a way that additional flags can be set. The additional flags can be used to perform a command injection.

Vendor-cookiecutter_project n/a Fedora Project

Product-cookiecutter fedora cookiecutter

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-15.55% / 94.42%

||

7 Day CHG~0.00%

Published-04 Feb, 2022 | 01:33

Updated-03 Aug, 2024 | 04:07

Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetQvlanList. This vulnerability allows attackers to execute arbitrary commands via the qvlanIP parameter.

Vendor-n/a Tenda Technology Co., Ltd.

Product-g3 g1_firmware g1 g3_firmware n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-Not Assigned

Published-28 Aug, 2025 | 00:00

Updated-29 Aug, 2025 | 16:24

D-Link DIR-868L B1 router firmware version FW2.05WWB02 contains an unauthenticated OS command injection vulnerability in the fileaccess.cgi component. The endpoint /dws/api/UploadFile accepts a pre_api_arg parameter that is passed directly to system-level shell execution functions without sanitization or authentication. Remote attackers can exploit this to execute arbitrary commands as root via crafted HTTP requests.

Vendor-n/a

Product-n/a

CWE ID-CWE-306

Missing Authentication for Critical Function

CWE ID-CWE-668

Exposure of Resource to Wrong Sphere

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-4.12% / 88.17%

||

7 Day CHG~0.00%

Published-05 May, 2023 | 00:00

Updated-29 Jan, 2025 | 18:15

TOTOLINK A7100RU V7.4cu.2313_B20191024 is vulnerable to Command Injection.

Vendor-n/a TOTOLINK

Product-a7100ru_firmware a7100ru n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-JPCERT/CC

Matching Score-4

Assigner-JPCERT/CC

CVSS Score-7.5||HIGH

EPSS-2.63% / 85.11%

||

7 Day CHG~0.00%

Published-11 Mar, 2011 | 17:00

Updated-11 Apr, 2025 | 00:51

webscript.pl in Open Ticket Request System (OTRS) 2.3.4 and earlier allows remote attackers to execute arbitrary commands via unspecified vectors, related to a "command injection vulnerability."

Vendor-n/a OTRS AG

Product-otrs n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-4.33% / 88.47%

||

7 Day CHG~0.00%

Published-04 Feb, 2022 | 01:32

Updated-03 Aug, 2024 | 04:07

Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetIpGroup. This vulnerability allows attackers to execute arbitrary commands via the IPGroupStartIP and IPGroupEndIP parameters.

Vendor-n/a Tenda Technology Co., Ltd.

Product-g3 g1_firmware g1 g3_firmware n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-GitHub, Inc.

Matching Score-4

Assigner-GitHub, Inc.

CVSS Score-8.1||HIGH

EPSS-1.85% / 82.26%

||

7 Day CHG~0.00%

Published-04 Feb, 2022 | 22:32

Updated-23 Apr, 2025 | 19:07

OS command injection in iTunesRPC-Remastered

iTunesRPC-Remastered is a Discord Rich Presence for iTunes on Windows utility. In affected versions iTunesRPC-Remastered did not properly sanitize image file paths leading to OS level command injection. This issue has been patched in commit cdcd48b. Users are advised to upgrade.

Vendor-itunesrpc-remastered_project bildsben

Product-itunesrpc-remastered iTunesRPC-Remastered

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-2.05% / 83.13%

||

7 Day CHG~0.00%

Published-05 May, 2023 | 00:00

Updated-29 Jan, 2025 | 17:15

Tenda AC18 v15.03.05.19(6318_)_cn was discovered to contain a command injection vulnerability via the deviceName parameter in the setUsbUnload function.

Vendor-n/a Tenda Technology Co., Ltd.

Product-ac18 ac18_firmware n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-Snyk

Matching Score-4

Assigner-Snyk

CVSS Score-7.4||HIGH

EPSS-4.10% / 88.13%

||

7 Day CHG~0.00%

Published-15 Dec, 2022 | 03:44

Updated-17 Apr, 2025 | 19:15

Command Injection

The package cycle-import-check before 1.3.2 are vulnerable to Command Injection via the writeFileToTmpDirAndOpenIt function due to improper user-input sanitization.

Vendor-cycle-import-check_project n/a

Product-cycle-import-check cycle-import-check

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-25.38% / 96.00%

||

7 Day CHG~0.00%

Published-02 May, 2023 | 00:00

Updated-30 Jan, 2025 | 17:15

GL.iNET MT3000 4.1.0 Release 2 is vulnerable to OS Command Injection via /usr/lib/oui-httpd/rpc/logread.

Vendor-gl-inet n/a

Product-gl-mt3000_firmware gl-mt3000 n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.45% / 80.02%

||

7 Day CHG~0.00%

Published-14 Apr, 2023 | 00:00

Updated-06 Feb, 2025 | 21:15

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain multiple command injection vulnerabilities via the rtLogEnabled and rtLogServer parameters in the setSyslogCfg function.

Vendor-n/a TOTOLINK

Product-x18_firmware x18 n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.45% / 80.02%

||

7 Day CHG~0.00%

Published-14 Apr, 2023 | 00:00

Updated-06 Feb, 2025 | 21:15

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the command parameter in the setTracerouteCfg function.

Vendor-n/a TOTOLINK

Product-x18_firmware x18 n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-4.88% / 89.16%

||

7 Day CHG~0.00%

Published-08 May, 2023 | 00:00

Updated-29 Jan, 2025 | 19:15

Metersphere v1.20.20-lts-79d354a6 is vulnerable to Remote Command Execution. The system command reverse-shell can be executed at the custom code snippet function of the metersphere system workbench

Vendor-n/a MeterSphere (FIT2CLOUD Inc.)

Product-metersphere n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-5.89% / 90.24%

||

7 Day CHG~0.00%

Published-23 Nov, 2022 | 00:00

Updated-25 Apr, 2025 | 21:15

OPTILINK OP-XT71000N V2.2 is vulnerable to Remote Code Execution. The issue occurs when the attacker sends an arbitrary code on "/diag_ping_admin.asp" to "PingTest" interface that leads to COMMAND EXECUTION. An attacker can successfully trigger the COMMAND and can compromise full system.

Vendor-optilinknetwork n/a

Product-op-xt71000n_firmware op-xt71000n n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-5.85% / 90.20%

||

7 Day CHG~0.00%

Published-07 Apr, 2022 | 10:19

Updated-03 Aug, 2024 | 03:59

A command injection vulnerability in the API of the Wavlink WL-WN531P3 router, version M31G3.V5030.201204, allows an attacker to achieve unauthorized remote code execution via a malicious POST request through /cgi-bin/adm.cgi.

Vendor-n/a WAVLINK Technology Ltd.

Product-wl-wn531p3_firmware wl-wn531p3 n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-22.39% / 95.61%

||

7 Day CHG~0.00%

Published-07 Mar, 2022 | 12:48

Updated-03 Aug, 2024 | 04:07

CasaOS before v0.2.7 was discovered to contain a command injection vulnerability.

Vendor-icewhale n/a

Product-casaos n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-52.73% / 97.85%

||

7 Day CHG~0.00%

Published-11 Jun, 2019 | 20:46

Updated-30 Jul, 2025 | 01:46

Known KEV||Action Due Date - 2022-05-06||Apply updates per vendor instructions.

On certain Ubiquiti devices, Command Injection exists via a GET request to stainfo.cgi (aka Show AP info) because the ifname variable is not sanitized, as demonstrated by shell metacharacters. The fixed version is v4.0.1 for 802.11 ISP products, v5.3.5 for AirMax ISP products, and v5.4.5 for AirSync firmware. For example, Nanostation5 (Air OS) is affected.

Vendor-n/a Ubiquiti Inc.

Product-airos n/a AirOS

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-Schneider Electric

Matching Score-4

Assigner-Schneider Electric

CVSS Score-9.8||CRITICAL

EPSS-4.67% / 88.89%

||

7 Day CHG~0.00%

Published-18 Apr, 2023 | 20:50

Updated-05 Feb, 2025 | 21:00

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability exists that could cause remote code execution when manipulating internal methods through Java RMI interface.

Vendor-Microsoft Corporation Schneider Electric SE

Product-windows_server_2016 apc_easy_ups_online_monitoring_software easy_ups_online_monitoring_software windows_11 windows_10 windows_server_2022 windows_server_2019 Schneider Electric Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)APC Easy UPS Online Monitoring Software (Windows 10, 11 Windows Server 2016, 2019, 2022)

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.11% / 30.49%

||

7 Day CHG~0.00%

Published-27 Aug, 2025 | 00:00

Updated-29 Aug, 2025 | 19:15

In RaspAP raspap-webgui 3.3.2 and earlier, a command injection vulnerability exists in the includes/hostapd.php script. The vulnerability is due to improper sanitizing of user input passed via the interface parameter.

Vendor-n/a

Product-n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-23.75% / 95.78%

||

7 Day CHG~0.00%

Published-14 Oct, 2021 | 10:50

Updated-04 Aug, 2024 | 14:51

A remote command execution vulnerability exists in add_server_service of PPTP_SERVER in Mercury Router MER1200 v1.0.1 and Mercury Router MER1200G v1.0.1.

Vendor-mercury n/a

Product-mer1200_firmware mer1200g mer1200g_firmware mer1200 n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-Not Assigned

Published-29 Aug, 2025 | 00:00

Updated-29 Aug, 2025 | 19:40

TRENDnet TV-IP410 vA1.0R was discovered to contain an OS command injection vulnerability via the /server/cgi-bin/testserv.cgi component.

Vendor-n/a

Product-n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.13% / 32.98%

||

7 Day CHG~0.00%

Published-03 Jun, 2024 | 19:58

Updated-04 Apr, 2025 | 16:32

TOTOLINK LR350 V9.3.5u.6369_B20220309 was discovered to contain a command injection via the host_time parameter in the NTPSyncWithHost function.

Vendor-n/a TOTOLINK

Product-lr350_firmware lr350 n/a lr350_firmware

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-4.25% / 88.34%

||

7 Day CHG~0.00%

Published-04 Jun, 2024 | 17:14

Updated-13 Feb, 2025 | 15:59

Tenda O3V2 v1.0.0.12(3880) was discovered to contain a Blind Command Injection via stpEn parameter in the SetStp function. This vulnerability allows attackers to execute arbitrary commands with root privileges.

Vendor-n/a Tenda Technology Co., Ltd.

Product-o3_firmware o3 n/a o3v2_firmware

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.45% / 80.02%

||

7 Day CHG~0.00%

Published-14 Apr, 2023 | 00:00

Updated-06 Feb, 2025 | 21:15

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the FileName parameter in the UploadFirmwareFile function.

Vendor-n/a TOTOLINK

Product-x18_firmware x18 n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-2.17% / 83.65%

||

7 Day CHG~0.00%

Published-24 Apr, 2023 | 00:00

Updated-04 Feb, 2025 | 17:15

huedawn-tesseract 0.3.3 and dawnsparks-node-tesseract 0.4.0 to 0.4.1 was discovered to contain a remote code execution (RCE) vulnerability via the child_process function.

Vendor-huedawn-tesseract_project dawnsparks-node-tesseract_project n/a

Product-dawnsparks-node-tesseract huedawn-tesseract n/a

CWE ID-CWE-94

Improper Control of Generation of Code ('Code Injection')

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.80% / 73.11%

||

7 Day CHG~0.00%

Published-07 Jun, 2024 | 03:24

Updated-01 May, 2025 | 19:49

Roundcube Webmail before 1.5.7 and 1.6.x before 1.6.7 on Windows allows command injection via im_convert_path and im_identify_path. NOTE: this issue exists because of an incomplete fix for CVE-2020-12641.

Vendor-n/a Roundcube Webmail Project

Product-webmail n/a roundcube_webmail

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-4.33% / 88.47%

||

7 Day CHG~0.00%

Published-04 Feb, 2022 | 01:33

Updated-03 Aug, 2024 | 04:07

Tenda routers G1 and G3 v15.11.0.17(9502)_CN were discovered to contain a command injection vulnerability in the function formSetDMZ. This vulnerability allows attackers to execute arbitrary commands via the dmzHost1 parameter.

Vendor-n/a Tenda Technology Co., Ltd.

Product-g3 g1_firmware g1 g3_firmware n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.59% / 80.90%

||

7 Day CHG~0.00%

Published-10 May, 2023 | 00:00

Updated-27 Jan, 2025 | 20:15

Shenzen Tenda Technology IP Camera CP3 V11.10.00.2211041355 allows unauthenticated remote code execution via an XML document.

Vendor-n/a Tenda Technology Co., Ltd.

Product-cp3_firmware cp3 n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-Snyk

Matching Score-4

Assigner-Snyk

CVSS Score-7.4||HIGH

EPSS-0.32% / 54.03%

||

7 Day CHG~0.00%

Published-21 Dec, 2022 | 23:14

Updated-15 Apr, 2025 | 20:15

Command Injection

All versions of package abacus-ext-cmdline are vulnerable to Command Injection via the execute function due to improper user-input sanitization.

Vendor-abacus-ext-cmdline_project n/a

Product-abacus-ext-cmdline abacus-ext-cmdline

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.74% / 81.72%

||

7 Day CHG~0.00%

Published-15 Aug, 2024 | 00:00

Updated-20 Aug, 2024 | 15:35

Command injection vulnerability in Asus RT-N15U 3.0.0.4.376_3754 allows a remote attacker to execute arbitrary code via the netstat function page.

Vendor-n/a ASUS (ASUSTeK Computer Inc.)

Product-n/a rt-n15u_firmware

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.45% / 80.02%

||

7 Day CHG~0.00%

Published-14 Apr, 2023 | 00:00

Updated-06 Feb, 2025 | 21:09

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the hostname parameter in the setOpModeCfg function.

Vendor-n/a TOTOLINK

Product-x18 x18_firmware n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-2.53% / 84.86%

||

7 Day CHG~0.00%

Published-27 Jul, 2022 | 13:23

Updated-03 Aug, 2024 | 03:36

OX App Suite through 7.10.6 allows OS Command Injection via Documentconverter (e.g., through an email attachment).

Vendor-n/a Open-Xchange AG

Product-ox_app_suite n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.45% / 80.02%

||

7 Day CHG~0.00%

Published-14 Apr, 2023 | 00:00

Updated-06 Feb, 2025 | 21:15

TOTOLINK X18 V9.1.0cu.2024_B20220329 was discovered to contain a command injection vulnerability via the ip parameter in the setDiagnosisCfg function.

Vendor-n/a TOTOLINK

Product-x18_firmware x18 n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-4.67% / 88.91%

||

7 Day CHG~0.00%

Published-24 May, 2024 | 20:29

Updated-10 Jun, 2025 | 17:24

Mocodo Mocodo Online 4.2.6 and below does not properly sanitize the sql_case input field in /web/generate.php, allowing remote attackers to execute arbitrary commands and potentially command injection, leading to remote code execution (RCE) under certain conditions.

Vendor-mocodo n/a mocodo

Product-mocodo_online n/a mocodo_online

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-WPScan

Matching Score-4

Assigner-WPScan

CVSS Score-9.8||CRITICAL

EPSS-75.14% / 98.83%

||

7 Day CHG~0.00%

Published-15 Aug, 2022 | 08:36

Updated-03 Aug, 2024 | 00:32

VR Calendar < 2.3.2 - Unauthenticated Arbitrary Function Call

The VR Calendar WordPress plugin through 2.3.2 lets any user execute arbitrary PHP functions on the site.

Vendor-vr_calendar_project Unknown

Product-vr_calendar VR Calendar

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.54% / 66.48%

||

7 Day CHG~0.00%

Published-06 Apr, 2023 | 00:00

Updated-12 Feb, 2025 | 17:15

inventory in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attacker to run arbitrary commands on the platform operating system and achieve administrative access, aka OSFOURK-23543.

Vendor-atos n/a

Product-unify_openscape_4000_manager unify_openscape_4000 n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-1.46% / 80.05%

||

7 Day CHG~0.00%

Published-31 Mar, 2017 | 15:00

Updated-20 Apr, 2025 | 01:37

The _httpsrequest function in Snoopy allows remote attackers to execute arbitrary commands. NOTE: this issue exists dues to an incomplete fix for CVE-2008-4796.

Vendor-snoopy n/a Red Hat, Inc.Nagios Enterprises, LLC

Product-snoopy nagios openstack n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-Hewlett Packard Enterprise (HPE)

Matching Score-4

Assigner-Hewlett Packard Enterprise (HPE)

CVSS Score-9.8||CRITICAL

EPSS-1.29% / 78.85%

||

7 Day CHG~0.00%

Published-24 Sep, 2024 | 18:10

Updated-26 Sep, 2024 | 13:32

Unauthenticated Command Injection Vulnerabilities in the CLI Service Accessed by the PAPI Protocol

Command injection vulnerabilities in the underlying CLI service could lead to unauthenticated remote code execution by sending specially crafted packets destined to the PAPI (Aruba's Access Point management protocol) UDP port (8211). Successful exploitation of these vulnerabilities results in the ability to execute arbitrary code as a privileged user on the underlying operating system.

Vendor-Aruba Networks Hewlett Packard Enterprise (HPE)

Product-Aruba OS arubaos

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.40% / 60.07%

||

7 Day CHG~0.00%

Published-28 Aug, 2024 | 00:00

Updated-29 Aug, 2024 | 13:25

Beijing Digital China Cloud Technology Co., Ltd. DCME-320 v.7.4.12.60 has a command execution vulnerability, which can be exploited to obtain device administrator privileges via the getVar function in the code/function/system/tool/ping.php file.

Vendor-n/a beijing_digital_china_cloud_technology

Product-n/a dcme-320

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-0.45% / 62.61%

||

7 Day CHG~0.00%

Published-06 Apr, 2023 | 00:00

Updated-12 Feb, 2025 | 17:15

webservice in Atos Unify OpenScape 4000 Platform and OpenScape 4000 Manager Platform 10 R1 before 10 R1.34.4 allows an unauthenticated attacker to run arbitrary commands on the platform operating system and achieve administrative access, aka OSFOURK-23710.

Vendor-atos n/a

Product-unify_openscape_4000_manager unify_openscape_4000 n/a

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-12.78% / 93.75%

||

7 Day CHG~0.00%

Published-22 Jul, 2024 | 00:00

Updated-03 Apr, 2025 | 15:48

TOTOLINK A6000R V1.0.1-B20201211.2000 was discovered to contain a command injection vulnerability via the ifname parameter in the apcli_cancel_wps function.

Vendor-n/a TOTOLINK

Product-a6000r_firmware a6000r n/a a6000r_firmware

CWE ID-CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-53.69% / 97.91%

||

7 Day CHG~0.00%

Published-26 Jun, 2023 | 00:00

Updated-03 Dec, 2024 | 17:20

Command Injection vulnerability in OpenWB 1.6 and 1.7 allows remote attackers to run arbitrary commands via crafted GET request.

Vendor-openwb n/a

Product-openwb n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Matching Score-4

Assigner-MITRE Corporation

Matching Score-4

Assigner-MITRE Corporation

CVSS Score-9.8||CRITICAL

EPSS-91.75% / 99.67%

||

7 Day CHG~0.00%

Published-05 May, 2023 | 00:00

Updated-29 Jan, 2025 | 18:15

TOTOLINK X5000R V9.1.0u.6118_B20201102 and V9.1.0u.6369_B20230113 contain a command insertion vulnerability in setting/setTracerouteCfg. This vulnerability allows an attacker to execute arbitrary commands through the "command" parameter.

Vendor-n/a TOTOLINK

Product-x5000r_firmware x5000r n/a

CWE ID-CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')