Zyxel DSL CPE OS Command Injection Vulnerability

Multiple Zyxel DSL CPE devices contain a post-authentication command injection vulnerability in the CGI program that could allow an authenticated attacker to execute OS commands via a crafted HTTP request...

CVE-2024-23690

The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulnerability in the Telnet interface. An authenticated and remote attacker can execute arbitrary OS commands as root over Telnet by sending crafted "util backupconfiguration" commands...

CVE-2021-35028

A command injection vulnerability in the CGI program of the Zyxel VPN2S firmware version 1.12 could allow an authenticated, local user to execute arbitrary OS commands...

CVE-2022-30526

A privilege escalation vulnerability was identified in the CLI command of Zyxel USG FLEX 100W firmware versions 4.50 through 5.30, USG FLEX 200 firmware versions 4.50 through 5.30, USG FLEX 500 firmware versions 4.50 through 5.30, USG FLEX 700 firmware versions 4.50 through 5.30, USG FLEX 50W...

CVE-2022-2253

A user with administrative privileges in Distributed Data Systems WebHMI 4.1.1.7662 may send OS commands to execute on the host server...

CVE-2024-43385

A low privileged remote attacker can trigger the execution of arbitrary OS commands as root due to improper neutralization of special elements in the variable PROXYHTTPPORT in mGuard devices...

CVE-2024-52803

LLama Factory enables fine-tuning of large language models. A critical remote OS command injection vulnerability has been identified in the LLama Factory training process. This vulnerability arises from improper handling of user input, allowing malicious actors to execute arbitrary OS commands on...

CVE-2024-52324

Ruijie Reyee OS versions 2.206.x up to but not including 2.320.x uses an inherently dangerous function which could allow an attacker to send a malicious MQTT message resulting in devices executing arbitrary OS commands...

CVE-2024-1522

A Cross-Site Request Forgery CSRF vulnerability in the parisneo/lollms-webui project allows remote attackers to execute arbitrary code on a victim's system. The vulnerability stems from the /executecode API endpoint, which does not properly validate requests, enabling an attacker to craft a...

CVE-2024-6071

PTC Creo Elements/Direct License Server exposes a web interface which can be used by unauthenticated remote attackers to execute arbitrary OS commands on the server...

CVE-2024-28748

A remote attacker with high privileges may use a reading file function to inject OS commands...

CVE-2024-28750

A remote attacker with high privileges may use a deleting file function to inject OS commands...

CVE-2024-28749

A remote attacker with high privileges may use a writing file function to inject OS commands...

CVE-2024-8234

UNSUPPORTED WHEN ASSIGNED A command injection vulnerability in the functions formSysCmd, formUpgradeCert, and formDelcert in the Zyxel NWA1100-N firmware version 1.00AACE.1C0 could allow an unauthenticated attacker to execute some OS commands to access system files on an affected device...

CVE-2024-23690

CVE-2024-23690 affects end-of-life NETGEAR FVS336Gv2/v3 routers. A command injection in the Telnet interface allows an authenticated, remote attacker to run arbitrary OS commands as root by sending crafted "util backup_configuration" commands. Impact is OS command execution with root privileges o...

CVE-2024-23690 EOL Netgear FVS336v3 Telnet Configuration Backup Command Injection

The end-of-life Netgear FVS336Gv2 and FVS336Gv3 are affected by a command injection vulnerability in the Telnet interface. An authenticated and remote attacker can execute arbitrary OS commands as root over Telnet by sending crafted "util backupconfiguration" commands...

CVE-2024-53942

An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to command injection via the 2.4 GHz and 5 GHz name parameters, allowing a remote attacker to execute arbitrary OS commands on the device with root-level permissions via...

CVE-2024-53942

The NRadio N8-180 running NROS-1.9.2.n3.c5 firmware contains a command injection vulnerability in the /cgi-bin/luci/nradio/basic/radio endpoint. The flaw exists within the 2.4 GHz and 5 GHz name parameters, where failure to properly neutralize special elements allows a remote attacker to execute ...

CVE-2024-53942

An issue was discovered on NRadio N8-180 NROS-1.9.2.n3.c5 devices. The /cgi-bin/luci/nradio/basic/radio endpoint is vulnerable to command injection via the 2.4 GHz and 5 GHz name parameters, allowing a remote attacker to execute arbitrary OS commands on the device with root-level permissions via...

OS Command Injection

github.com/mayuresh82/gocast is vulnerable to OS Command Injection. The vulnerability is due to improper validation of user input in the name parameter, which allows specially crafted HTTP requests to inject and execute arbitrary OS commands...