THE INTERNET IS THINKING
Earlier sources: Command Injection
This security thread follows command injection through original research, public projects, and source reports. Read the evidence below to see which developments are represented in SYMTRI’s archive.
SYMTRI organizes observations from public sources into a living map. Connections reflect shared subject matter; they do not establish causation or endorse a source.
Open in the map ↗3 classified signals in the fourteen-day window. These counts include signals awaiting readable evidence.
Earlier sources
Up to ten sources with readable evidence, ordered by their feed timestamp. These archive sources can be older than the live fourteen-day window. This list is a sample, not a measure of total activity. Dates distinguish paper publication, repository creation, model/dataset activity, Hacker News posts, and KEV catalog additions. “First archived” records when SYMTRI first stored the signal.
- CISA · Added to KEV · First archived
CVE-2024-21887: Ivanti Connect Secure and Policy Secure Command Injection Vulnerability ↗
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web components of these products, which can allow an authenticated administrator to send crafted requests to execute code on affected appliances. This vulnerability can be leveraged in conjunction with CVE-2023-46805, an authenticated bypass issue. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Known. Added to the KEV catalog: 2024-01-10 (not the
- CISA · Added to KEV · First archived
CVE-2023-46805: Ivanti Connect Secure and Policy Secure Authentication Bypass Vulnerability ↗
Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure gateways contain an authentication bypass vulnerability in the web component that allows an attacker to access restricted resources by bypassing control checks. This vulnerability can be leveraged in conjunction with CVE-2024-21887, a command injection vulnerability. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Known. Added to the KEV catalog: 2024-01-10 (not the first disclosure date). Actio
- CISA · Added to KEV · First archived
CVE-2016-20017: D-Link DSL-2750B Devices Command Injection Vulnerability ↗
D-Link DSL-2750B devices contain a command injection vulnerability that allows remote, unauthenticated command injection via the login.cgi cli parameter. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-01-08 (not the first disclosure date). Action due date: 2024-01-29.
- CISA · Added to KEV · First archived
CVE-2023-49897: FXC AE1021, AE1021PE OS Command Injection Vulnerability ↗
FXC AE1021 and AE1021PE contain an OS command injection vulnerability that allows authenticated users to execute commands via a network. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2023-12-21 (not the first disclosure date). Action due date: 2024-01-11.
- CISA · Added to KEV · First archived
CVE-2023-47565: QNAP VioStor NVR OS Command Injection Vulnerability ↗
QNAP VioStar NVR contains an OS command injection vulnerability that allows authenticated users to execute commands via a network. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2023-12-21 (not the first disclosure date). Action due date: 2024-01-11.
- CISA · Added to KEV · First archived
CVE-2023-1671: Sophos Web Appliance Command Injection Vulnerability ↗
Sophos Web Appliance contains a command injection vulnerability in the warn-proceed handler that allows for remote code execution. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2023-11-16 (not the first disclosure date). Action due date: 2023-12-07.
- CISA · Added to KEV · First archived
CVE-2023-20273: Cisco IOS XE Web UI Command Injection Vulnerability ↗
Cisco IOS XE contains a command injection vulnerability in the web user interface. When chained with CVE-2023-20198, the attacker can leverage the new local user to elevate privilege to root and write the implant to the file system. Cisco identified CVE-2023-20273 as the vulnerability exploited to deploy the implant. CVE-2021-1435, previously associated with the exploitation events, is no longer believed to be related to this activity. Required action: Verify that instances of Cisco IOS XE Web UI are in compliance with BOD 23-02 and apply mitigations per vendor instructions. For affected produ
- CISA · Added to KEV · First archived
CVE-2017-6884: Zyxel EMG2926 Routers Command Injection Vulnerability ↗
Zyxel EMG2926 routers contain a command injection vulnerability located in the diagnostic tools, specifically the nslookup function. A malicious user may exploit numerous vectors to execute malicious commands on the router, such as the ping_ip parameter to the expert/maintenance/diagnostic/nslookup URI. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Known. Added to the KEV catalog: 2023-09-18 (not the first disclosure date). Action due date: 2023-10-09.
- CISA · Added to KEV · First archived
CVE-2017-18368: Zyxel P660HN-T1A Routers Command Injection Vulnerability ↗
Zyxel P660HN-T1A routers contain a command injection vulnerability in the Remote System Log forwarding function, which is accessible by an unauthenticated user and exploited via the remote_host parameter of the ViewLog.asp page. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2023-08-07 (not the first disclosure date). Action due date: 2023-08-28.
- CISA · Added to KEV · First archived
CVE-2022-29303: SolarView Compact Command Injection Vulnerability ↗
SolarView Compact contains a command injection vulnerability due to improper validation of input values on the send test mail console of the product's web server. Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2023-07-13 (not the first disclosure date). Action due date: 2023-08-03.
Live window recorded . This is the ingestion observation time, not the publication or discovery date of each source.
How to assess evidence about Command Injection
Check each original source for its methods, release status, limitations, and supporting data. A repository announcement, a preprint, and a published study provide different kinds of evidence. SYMTRI’s subject classification helps discovery; it does not independently validate the source’s claims.
See the collection and counting methodology ↗ · Read the weekly synthesis ↗
Related threads
Explore related regions
These navigation suggestions are part of the map’s editorial structure, rather than measured evidence of a connection.