Skip to content
Fencer Vulns
critical 9.8

CVE-2022-44877 kev in the critical feed json

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS comm…

published 2023-01-05 3 y ago modified 2026-06-17 4 mo ago also EUVD-2022-47807

cvss
9.8
version 3.1, CNA
cisa kev
Exploited
added 2023-01-17
epss
100.0%
EPSS 100.0% chance of exploitation in 30 days, percentile 99.9%
public exploits
3
Metasploit, Exploit-DB, plus a Nuclei check

Summary

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

Patch / fix

cisa required action Apply updates per vendor instructions.

  • control-webpanel webpanel 0.9.8.1147

Timeline

  1. Published
  2. First public exploit (Metasploit exploit/linux/http/control_web_panel_login_cmd_exec)
  3. Added to CISA KEV
  4. CISA patch deadline
  5. CISA SSVC: exploitation active

Known exploited

Added
3 y ago
Patch by
2023-02-07 (3 y ago)
Ransomware
Not known
Required action
Apply updates per vendor instructions.
Vendor, product
CWP, Control Web Panel
CISA name
CWP Control Web Panel OS Command Injection Vulnerability

CISA SSVC

Exploitation
Active, exploited in the wild
Automatable
yes
Technical impact
total
Assessed
21 mo ago

Exploit prediction

100.00% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • Metasploit exploit/linux/http/control_web_panel_login_cmd_exec CWP login.php Unauthenticated RCE metasploit exploit, excellent rank, 2023-01-05
  • EDB-51250 Control Web Panel 7 (CWP7) v0.9.8.1147 - Remote Code Execution (RCE) webapps, 2023-04-05
  • EDB-51194 Centos Web Panel 7 v0.9.8.1147 - Unauthenticated Remote Code Execution (RCE) webapps, 2023-04-01
  • Nuclei template CentOS Web Panel 7 <0.9.8.1147 - Remote Code Execution nuclei detection template
  • youtube.com https://www.youtube.com/watch?v=kiLfSvc1SYY referenced PoC, tagged "exploit" by a source, unverified
  • gist.github.com https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386 referenced PoC, tagged "exploit" by a source, unverified
  • seclists.org http://seclists.org/fulldisclosure/2023/Jan/1 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CISA ADP 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA 3.1 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Classification

Weakness
  • CWE-78 Improper Neutralization of Special Elements used in an OS Command

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.