THE INTERNET IS THINKING
Earlier sources: Command Injection
This security thread follows command injection through original research, public projects, and source reports. Read the evidence below to see which developments are represented in SYMTRI’s archive.
SYMTRI organizes observations from public sources into a living map. Connections reflect shared subject matter; they do not establish causation or endorse a source.
Open in the map ↗3 classified signals in the fourteen-day window. These counts include signals awaiting readable evidence.
Earlier sources
Up to ten sources with readable evidence, ordered by their feed timestamp. These archive sources can be older than the live fourteen-day window. This list is a sample, not a measure of total activity. Dates distinguish paper publication, repository creation, model/dataset activity, Hacker News posts, and KEV catalog additions. “First archived” records when SYMTRI first stored the signal.
- CISA · Added to KEV · First archived
CVE-2020-15415: DrayTek Multiple Vigor Routers OS Command Injection Vulnerability ↗
DrayTek Vigor3900, Vigor2960, and Vigor300B devices contain an OS command injection vulnerability in cgi-bin/mainfunction.cgi/cvmcfgupload that allows for remote code execution via shell metacharacters in a filename when the text/x-python-script content type is used. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-09-30 (not the first disclosure date). Action due date: 2024-10-21.
- CISA · Added to KEV · First archived
CVE-2024-8190: Ivanti Cloud Services Appliance OS Command Injection Vulnerability ↗
Ivanti Cloud Services Appliance (CSA) contains an OS command injection vulnerability in the administrative console which can allow an authenticated attacker with application admin privileges to pass commands to the underlying OS. Required action: As Ivanti CSA has reached End-of-Life status, users are urged to remove CSA 4.6.x from service or upgrade to the 5.0.x line of supported solutions, as future vulnerabilities on the 4.6.x version of CSA are unlikely to receive future security updates.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-09-13 (not the first disclosur
- CISA · Added to KEV · First archived
CVE-2024-20399: Cisco NX-OS Command Injection Vulnerability ↗
Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execute commands as root on the underlying operating system of an affected device. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-07-02 (not the first disclosure date). Action due date: 2024-07-23.
- CISA · Added to KEV · First archived
CVE-2024-4577: PHP-CGI OS Command Injection Vulnerability ↗
PHP, specifically Windows-based PHP used in CGI mode, contains an OS command injection vulnerability that allows for arbitrary code execution. This vulnerability is a patch bypass for CVE-2012-1823. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Known. Added to the KEV catalog: 2024-06-12 (not the first disclosure date). Action due date: 2024-07-03.
- CISA · Added to KEV · First archived
CVE-2017-3506: Oracle WebLogic Server OS Command Injection Vulnerability ↗
Oracle WebLogic Server, a product within the Fusion Middleware suite, contains an OS command injection vulnerability that allows an attacker to execute arbitrary code via a specially crafted HTTP request that includes a malicious XML document. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-06-03 (not the first disclosure date). Action due date: 2024-06-24.
- CISA · Added to KEV · First archived
CVE-2024-3400: Palo Alto Networks PAN-OS Command Injection Vulnerability ↗
Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute commands with root privileges on the firewall. Required action: Apply mitigations per vendor instructions as they become available. Otherwise, users with vulnerable versions of affected devices should enable Threat Prevention IDs available from the vendor. See the vendor bulletin for more details and a patch release schedule.. Known ransomware campaign use: Known. Added to the KEV catalog: 2024-04-12 (not the first disclosure date). Action due date: 2024
- CISA · Added to KEV · First archived
CVE-2024-3273: D-Link Multiple NAS Devices Command Injection Vulnerability ↗
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contain a command injection vulnerability. When combined with CVE-2024-3272, this can lead to remote, unauthorized code execution. Required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-04-11 (not the first disclosure date). Action due date: 2024-05-02.
- CISA · Added to KEV · First archived
CVE-2024-3272: D-Link Multiple NAS Devices Use of Hard-Coded Credentials Vulnerability ↗
D-Link DNS-320L, DNS-325, DNS-327L, and DNS-340L contains a hard-coded credential that allows an attacker to conduct authenticated command injection, leading to remote, unauthorized code execution. Required action: This vulnerability affects legacy D-Link products. All associated hardware revisions have reached their end-of-life (EOL) or end-of-service (EOS) life cycle and should be retired and replaced per vendor instructions.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-04-11 (not the first disclosure date). Action due date: 2024-05-02.
- CISA · Added to KEV · First archived
CVE-2019-7256: Nice Linear eMerge E3-Series OS Command Injection Vulnerability ↗
Nice Linear eMerge E3-Series contains an OS command injection vulnerability that allows an attacker to conduct remote code execution. Required action: Contact the vendor for guidance on remediating firmware, per their advisory.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-03-25 (not the first disclosure date). Action due date: 2024-04-15.
- CISA · Added to KEV · First archived
CVE-2021-36380: Sunhillo SureLine OS Command Injection Vulnerablity ↗
Sunhillo SureLine contains an OS command injection vulnerability that allows an attacker to cause a denial-of-service or utilize the device for persistence on the network via shell metacharacters in ipAddr or dnsAddr in /cgi/networkDiag.cgi. Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.. Known ransomware campaign use: Unknown. Added to the KEV catalog: 2024-03-05 (not the first disclosure date). Action due date: 2024-03-26.
Live window recorded . This is the ingestion observation time, not the publication or discovery date of each source.
How to assess evidence about Command Injection
Check each original source for its methods, release status, limitations, and supporting data. A repository announcement, a preprint, and a published study provide different kinds of evidence. SYMTRI’s subject classification helps discovery; it does not independently validate the source’s claims.
See the collection and counting methodology ↗ · Read the weekly synthesis ↗
Related threads
Explore related regions
These navigation suggestions are part of the map’s editorial structure, rather than measured evidence of a connection.