InfoSecBulletin Cybersecurity for mankind
OS command injection vulnerabilities are a preventable type of weakness in software. Manufacturers can eliminate them by taking a secure design approach. Despite efforts, these vulnerabilities still appear, allowing adversaries to exploit them for harm.
CISA and FBI are releasing this Alert because of recent well-known attacks that took advantage of OS command injection flaws in network devices (CVE-2024-20399, CVE-2024-3400, CVE-2024-21887). These vulnerabilities allowed attackers to remotely execute code on the devices.
Delay patching leaves about 50,000 Fortinet firewalls to zero-day attack
Daily Security Update Dated: 21.01.2025
126 Linux kernel Vulns Allow Attackers Exploit 78 Linux Sub-Systems
CERT-UA alerts about “security audit” requests through AnyDesk
Oracle Critical Pre-Release update addressed 320 flaw
OWASP Reveils Top 10 Smart Contract Vulnerabilities for 2025
Multiple Azure DevOps Vulns Allow To Inject CRLF Queries & Rebind DNS
Intel holds 22 employees from one Bangladeshi University
VPN Surge 1500% in USA after TikTok Shut Down
MITRE Launches D3FEND 1.0; The Milestone for Cybersecurity Ontology
OS command injection vulnerabilities occur when manufacturers do not correctly validate and sanitize user input when creating commands to run on the operating system. Creating software that blindly trusts user input without proper validation or sanitization can enable attackers to execute harmful commands, endangering customers.
CISA and FBI want CEOs and business leaders at technology companies to ask their technical teams to analyze past issues and make a plan to prevent them in the future.
To further prevent these vulnerabilities, technical leaders should:
Ensure software uses functions that generate commands in safer ways by preserving the intended syntax of the command and its arguments
Review their threat models
Use modern component libraries
Conduct code reviews
And implement aggressive adversarial product testing to ensure the quality and security of their code throughout the development lifecycle.
To read the full report click here.
