CISA and FBI Release Secure by Design Alert on Eliminating OS Command Injection Vulnerabilities

CISA and FBI Release Secure by Design Alert on Eliminating OS Command Injection Vulnerabilities ↗ source

July 10, 2024 CISA Alert

Co-sealed by: CISA, FBI

Source: https://www.cisa.gov/news-events/alerts/2024/07/10/cisa-and-fbi-release-secure-design-alert-eliminating-os-command-injection-vulnerabilities

Summary

These vulnerabilities allowed unauthenticated malicious actors to remotely execute code on network edge devices. OS command injection vulnerabilities have long been preventable by clearly separating user input from the contents of a command. Despite this finding, OS command injection vulnerabilities—many of which result from CWE-78—are still a prevalent class of vulnerability. This product is provided subject to this Notification and this Privacy & Use policy.

News Coverage

No coverage found in monitored research blogs or news feeds.

CVEs Referenced in This Publication

CVE	CVSS	Affected
CVE-2024-3400	10.0 Critical	Palo Alto Networks PAN-OS Palo Alto Networks PAN-OS GlobalProtect feature contains a command injection vulnerability that allows an unauthenticated attacker to execute command…
CVE-2024-21887	9.1 Critical	Ivanti Connect Secure and Policy Secure Ivanti Connect Secure (ICS, formerly known as Pulse Connect Secure) and Ivanti Policy Secure contain a command injection vulnerability in the web com…
CVE-2024-20399	6.0 Medium	Cisco NX-OS Cisco NX-OS contains a command injection vulnerability in the command line interface (CLI) that could allow an authenticated, local attacker to execu…

Extracted from the publication text. Each CVE links to its tracked detail page.

Vendors Named in This Publication

Cisco 99 KEV Ivanti 35 KEV Palo Alto Networks 15 KEV

Each vendor links to its Known Exploited Vulnerabilities catalog page. Only vendors that appear in the KEV catalog are listed, either because the publication cites one of their KEV entries or because it names them directly.