CVE-2022-44877: CWP Control Web Panel OS Command Injection Vulnerability

Critical severity · published Jan 5, 2023

CVE-2022-44877

CWP Control Web Panel OS Command Injection Vulnerability

In wildKEV

9.8

CVSS

100%

EPSS

Yes

On KEV

Description

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)100.0% · higher than 100% of CVEs

Exploited in the wildYes

CISA KEVListed Jan 17, 2023

Federal remediation dueFeb 7, 2023

Ransomware campaign useNot known

Affected products

Which versions

Webpanel · Control-webpanel

before 0.9.8.1147 · source: NVD

Control Web Panel · CWP

All versions, or not specified · source: KEV

Affected product

Webpanel

Control-webpanel

All Webpanel CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-44877

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-44877

CISA KEV catalogue

https://www.cisa.gov/known-exploited-vulnerabilities-catalog

www.youtube.com

https://www.youtube.com/watch?v=kiLfSvc1SYY

gist.github.com

https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386

mailing-list

http://seclists.org/fulldisclosure/2023/Jan/1

packetstormsecurity.com

http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html

packetstormsecurity.com

http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html

packetstormsecurity.com

http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html