Falhas do tipo CWE-134

144 resultados

Uso de String de Formatação Controlada Externamente

Ocorre quando um programa usa entrada do usuário diretamente como argumento de formato em funções como printf(), sprintf() ou similares, sem validação. Um atacante pode injetar especificadores de formato (%x, %s, %n) para ler memória, derrubar a aplicação ou executar código arbitrário.

Exemplo

Um programa web recebe um parâmetro GET e faz printf(usuario_input) em vez de printf("%s", usuario_input). Um atacante envia ?name=%x%x%x e consegue vazar valores da pilha, ou usa %n para escrever na memória.

Como mitigar

Sempre use string de formato estática e fixa (literal), nunca construída a partir de entrada externa. Valide e sanitize qualquer dado de usuário antes de usá-lo em funções de formatação. Ferramentas como -Wformat-security do GCC ajudam a detectar isso em tempo de compilação.

CVE-2021-33535HIGHWEIDMUELLER: WLAN devices affected by exploitable format string vulnerabilityEPSS 1.6%CVE-2022-34747CRITICALA format string vulnerability in Zyxel NAS326 firmware versions prior to V5.21(AAZF.12)C0 could allow an attacker to achieve unauthorized reEPSS 1.5%CVE-2020-15634MEDIUMThis vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of NETGEAR R6700 routers with firmwEPSS 1.4%CVE-2025-64157MEDIUMA use of externally-controlled format string vulnerability in Fortinet FortiOS 7.6.0 through 7.6.4, FortiOS 7.4.0 through 7.4.9, FortiOS 7.2EPSS 1.4%CVE-2022-35244CRITICALA format string injection vulnerability exists in the XCMD getVarHA functionality of abode systems, inc. iota All-In-One Security Kit 6.9X aEPSS 1.3%CVE-2022-35884HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2022-35887HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.3%CVE-2025-46121CRITICALAn issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, where the functions `stamgr_cfg_adpt_addSEPSS 1.2%CVE-2022-35885HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.2%CVE-2022-35886HIGHFour format string injection vulnerabilities exist in the web interface /action/wirelessConnect functionality of Abode Systems, Inc. iota AlEPSS 1.2%CVE-2024-6145HIGHActiontec WCB6200Q Cookie Format String Remote Code Execution VulnerabilityEPSS 1.2%CVE-2023-39238HIGHASUS RT-AX55、RT-AX56U_V2 - Format String - 1EPSS 1.2%CVE-2024-35845CRITICALwifi: iwlwifi: dbg-tlv: ensure NUL terminationEPSS 1.2%CVE-2023-39239HIGHASUS RT-AX55、RT-AX56U_V2、RT-AC86U - Format String - 2EPSS 1.2%CVE-2023-39240HIGHASUS RT-AX55、RT-AX56U_V2 - Format String - 3EPSS 1.2%CVE-2019-6840—A Format String: CWE-134 vulnerability exists in U.motion Server (MEG6501-0001 - U.motion KNX server, MEG6501-0002 - U.motion KNX Server PluEPSS 1.1%CVE-2025-46123HIGHAn issue was discovered in CommScope Ruckus Unleashed prior to 200.15.6.212.14 and 200.17.7.0.139, and in Ruckus ZoneDirector prior to 10.5.EPSS 1.1%CVE-2023-35087CRITICALASUS RT-AX56U V2 & RT-AC86U - Format String - 2EPSS 1.1%CVE-2023-36639HIGHA use of externally-controlled format string in Fortinet FortiProxy versions 7.2.0 through 7.2.4, 7.0.0 through 7.0.10, FortiOS versions 7.4EPSS 1.1%CVE-2020-1979HIGHPAN-OS: A format string vulnerability in PAN-OS log daemon (logd) on Panorama allows local privilege escalationEPSS 1.0%