peter bassill · operator
$ cve CVE-2022-44877 JSON

CVE-2022-44877 KEV EXPLOIT

9.8
CRITICAL · CVSS 3.1 · EPSS 100% (pctl 100)

Patch first

On CISA KEV — known exploited in the wild, due 2023-02-07.

Description

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

Scoring

CVSS9.8 (CRITICAL, v3.1)
VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS100% — more likely to be exploited than 100% of all CVEs
WeaknessCWE-78
On CISA KEVyes — remediate by 2023-02-07
Public exploityes
Published2023-01-05
Last modified2026-06-17

CISA KEV

NameCWP Control Web Panel OS Command Injection Vulnerability
Added2023-01-17
Due2023-02-07
Vendor / productCWP / Control Web Panel
Ransomware usenone reported

Affected (1)

VendorProduct
control-webpanelwebpanel

Public exploits

SourceTitleDate
exploit-dbControl Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE)2023-04-05
exploit-dbCentos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE)2023-04-01

References

→ the Explorer  ·  watch your stack  ·  NVD