CVE-2022-44877VulnerabilityPublished 01/17/2023Updated 10/24/2026

CVE-2022-44877: CWP Control Web Panel OS Command Injection Vulnerability

Affects CWP Control Web PanelSource CISA KEV

Severity

High

No CVSS score published yet

Exploitation: Actively exploited – in CISA KEV since 01/17/2023
KEV deadline: 02/07/2023
EPSS: 100.0% chance of exploitation in 30 days – higher than 99% of CVEs

What to do

CISA required action

Apply updates per vendor instructions.

control-webpanel.com/changelog (opens in a new tab)
nvd.nist.gov/vuln/detail/CVE-2022-44877 (opens in a new tab)

Description

CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.

Weaknesses

CWE-78OS Command Injection (opens in a new tab)

References

control-webpanel.com/changelog (opens in a new tab)
nvd.nist.gov/vuln/detail/CVE-2022-44877 (opens in a new tab)
cisa.gov/known-exploited-vulnerabilities-catalog?search=CVE-2022-44877 (opens in a new tab)

What to do

Description

Weaknesses

References

Related threats