{"id":"CVE-2022-44877","kind":"vulnerability","aliases":["CVE-2022-44877"],"related":[],"title":"control-webpanel webpanel: login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to…","description":"CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.\n\nCISA required action: Apply updates per vendor instructions.","summary":"CWP Control Web Panel (formerly CentOS Web Panel), a server control panel, has an OS command injection flaw in its login parameter. A remote attacker can run arbitrary operating system commands on the server by putting shell metacharacters in that field.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2023-01-17T00:00:00+00:00","products":[{"name":"CWP Control Web Panel","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"control-webpanel webpanel","fixed":["0.9.8.1147"],"affected":"< 0.9.8.1147","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["cwp","exploited","linux","other","self-hosted"],"not_affected_if":["not-cwp-installed"],"how_to_check":null,"fix":"Apply the vendor update for CWP Control Web Panel per vendor instructions; the affected and fixed versions are not stated in the sources.","status":"open","published_at":"2023-01-05T23:15:09+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:08:47+00:00","updated_at":"2026-10-23T22:29:04+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-10-23T21:08:47Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor update for CWP Control Web Panel per vendor instructions; the affected and fixed versions are not stated in the sources.","reach":"internet","impact":"high","summary":"CWP Control Web Panel (formerly CentOS Web Panel), a server control panel, has an OS command injection flaw in its login parameter. A remote attacker can run arbitrary operating system commands on the server by putting shell metacharacters in that field.","category":"other","who_cares":["cwp","self-hosted","linux"],"confidence":0.8,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary commands as root on the server","analyst_note":"Find affected and fixed CWP versions and the vendor advisory; check the CISA KEV entry for the due date and any listed mitigations.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["not-cwp-installed"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000457,"input_tokens":2808,"output_tokens":353,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2022':23A,26A '-44877':24A,27A '0.9.8.1147':18A '7':16A 'action':114C 'aka':8A 'allow':19A,99C 'appli':115C 'arbitrari':70B 'attack':21A,67B,101C 'cento':13A,48B,89C 'cisa':112C 'command':58B,73B,95C,104C 'contain':92C 'control':2A,9A,29A,33A,44B,53B,85C 'control-webpanel':1A,32A 'cve':22A,25A 'cwp':7A,28A,36B,43B,84C 'execut':103C 'exploit':37B 'field':83B 'flaw':60B 'former':47B,88C 'host':42B 'inject':59B,96C 'instruct':119C 'linux':38B 'login':63B,110C 'login/index.php':5A 'metacharact':80B,107C 'oper':71B 'os':57B,94C 'panel':11A,15A,31A,46B,50B,54B,87C,91C 'paramet':64B,111C 'per':117C 'put':78B 'remot':20A,66B,100C 'requir':113C 'run':69B 'self':41B 'self-host':40B 'server':52B,76B 'shell':79B,106C 'system':72B 'updat':116C 'vendor':118C 'via':105C 'vulner':97C 'web':10A,14A,30A,45B,49B,86C,90C 'webpanel':3A,4A,34A,35A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2023-01-05T23:15:09+00:00","kev":{"dateAdded":"2023-01-17","dueDate":"2023-02-07","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2022-44877","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2022-44877","severity":null,"published_at":"2023-01-17T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:47+00:00","note":null},{"source":"nvd","external_id":"CVE-2022-44877","url":"https://nvd.nist.gov/vuln/detail/CVE-2022-44877","severity":null,"published_at":"2023-01-05T23:15:09+00:00","modified_at":"2026-06-17T05:09:01+00:00","first_seen_at":"2026-10-23T22:29:04+00:00","fetched_at":"2026-10-23T22:29:04+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}