CVEvulnerability

CVE-2022-44877

9.8 CRITICAL Known exploited Published 2023-01-05 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

CWP Control Web Panel OS Command Injection Vulnerability — CWP Control Web Panel

CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.

Added to KEV
2023-01-17
Remediation due
2023-02-07
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://control-webpanel.com/changelog#1669855527714-450fb335-6194; https://nvd.nist.gov/vuln/detail/CVE-2022-44877
Status
Analyzed
Published
2023-01-05
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
9.8 CRITICAL — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-78

Description

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

Affected configurations

• control-webpanel webpanel (< 0.9.8.1147)

Related

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References