CWE-78 is the weakness category for improper neutralization of special elements used in operating system commands. It appears when software passes attacker-controlled input into a shell, command interpreter, or subprocess without strict validation. An attacker can then inject metacharacters or extra command fragments so the system executes unintended OS commands.
This matters because command injection often turns a simple request bug into full host compromise, especially in management-plane software that already has privileged access. In real attacks, a web form, API parameter, or backend job may be used to steer execution into system utilities, expose configuration data, or run arbitrary commands on the server. Defenses include avoiding shell calls where possible, using safe APIs, applying allowlists, escaping and quoting carefully, and running services with minimal privileges. In the context of SD-WAN orchestration, CWE-78 can turn administrative reachability into a direct path to the control infrastructure.