Recent intrusions are exploiting Cisco NX-OS, Palo Alto Networks PAN-OS, and Ivanti Connect Secure. In response, CISA and the FBI are calling upon business leaders and device manufacturers to take action. They want these actors to eliminate OS command injection vulnerabilities at the source. CISA and FBI published an alert stating that manufacturers are failing to validate and sanitize user input, allowing malicious actors to execute commands. Software manufacturers are advised to develop a secure design approach. Manufactures should use built-in library functions to separate commands from their arguments and validate user input. 

Read more: https://www.securityweek.com/cisa-fbi-urge-immediate-action-on-os-command-injection-vulnerabilities-in-network-devices/