Vulnerability record · CVE-2021-45466 · published 26 December 2022
CVE-2021-45466: CWP pre-auth request lets attacker plant authorized_keys file
Control Webpanel · Webpanel
Control Web Panel (CWP) before 0.9.8.1107 mishandles authorization on the api/?api=add_server&DHCP= endpoint, allowing a crafted request to write an authorized_keys text file into the /resources/ folder. Because the endpoint is reachable without credentials, this is a pre-auth file-write primitive on a hosting control panel that typically runs with elevated privileges.
Description
In CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1107, attackers can make a crafted request to api/?api=add_server&DHCP= to add an authorized_keys text file in the /resources/ folder.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automated analysis
critical priorityPre-auth network-reachable file write on an internet-facing control panel with a 9.8 CVSS score and high EPSS probability.
What it is
Control Web Panel (CWP) before 0.9.8.1107 mishandles authorization on the api/?api=add_server&DHCP= endpoint, allowing a crafted request to write an authorized_keys text file into the /resources/ folder. Because the endpoint is reachable without credentials, this is a pre-auth file-write primitive on a hosting control panel that typically runs with elevated privileges.
Impact
An attacker can place an attacker-controlled authorized_keys file on the server, which can lead to SSH key-based access and full compromise of the panel host. The CVSS vector rates confidentiality, integrity and availability impact as high.
Attack surface
Reached over the network via a crafted HTTP request to the api/?api=add_server&DHCP= endpoint; the CVSS vector (AV:N/AC:L/PR:N/UI:N) indicates no authentication and no user interaction are required.
Exploitation
Not listed in CISA KEV, but EPSS is 0.55338 (99th percentile) and references include an Exploit-tagged third-party advisory describing pre-auth RCE, so public exploitation detail exists. No ransomware group usage is documented in the record.
What to do
- Upgrade CWP to 0.9.8.1107 or later, per the vendor changelog.
- Restrict network access to the CWP panel and its api/ endpoints to trusted management IPs.
- Audit and remove unexpected authorized_keys files under /resources/ and other web-accessible paths.
- Rotate SSH keys and credentials on any host that ran an affected CWP version.
- Monitor the api/ endpoint for add_server and DHCP parameters in web logs.
Detection
- Search web logs for requests to api/ containing api=add_server and DHCP= parameters.
- Alert on creation or modification of authorized_keys files under /resources/ or other web-served directories.
- Monitor for new or changed SSH authorized_keys entries and unexpected SSH logins on CWP hosts.
- Baseline and review outbound or inbound connections to the CWP panel from untrusted sources.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
| Link | Tags |
|---|---|
| https://control-webpanel.com/changelog | Release NotesVendor Advisory |
| https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/ | ExploitThird Party Advisory |
| https://control-webpanel.com/changelog | Release NotesVendor Advisory |
| https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/ | ExploitThird Party Advisory |
Track CVE-2021-45466 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2021-45466), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
