Exploited vulnerability

CVE-2022-44877

TLP:CLEAR

CWP Control Web Panel OS Command Injection Vulnerability

CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.

Facts

Vendor: CWP
Product: Control Web Panel
CVSS: 9.8
EPSS (probability of exploitation within 30 days): 100 %
On CISA's Known Exploited Vulnerabilities list since: 17 January 2023
First known exploitation: 17 January 2023
CISA's deadline for US federal agencies: 7 February 2023
Weakness: CWE-78
First seen by Risk Letters: 17 January 2023

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD