CVE-2022-44877criticalunder attackCWE-78

CVE-2022-44877

Published · Updated

Follow this CVE+ Monitor Control Web Panel

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 9.8epss 100%
from disclosure to weaponsame day
Published on NVDJan 5
1st PoCJan 5
metasploitJan 5
CISA KEV+12d
Action required by CISAfederal deadline: 2023-02-07

Apply updates per vendor instructions.

In short

A login page in CWP (Control Web Panel) version 7 allows attackers to run harmful commands on the server by sneaking special characters into the login field. This is critical because it gives attackers full control of the server without needing a valid account.

Technical detail

CWE-78 OS Command Injection in login/index.php allows unauthenticated remote attackers to execute arbitrary system commands through unsanitized shell metacharacters in the login parameter. The vulnerability affects CWP 7.x before 0.9.8.1147 and requires no authentication; successful exploitation grants complete OS-level access to the affected server.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
n/a · n/a
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.