CVE-2022-44877: CWP Control Web Panel login parameter OS command injection

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityUnauthenticated remote OS command execution with a CVSS score of 9.8, public exploit code, KEV listing, and an EPSS probability near 1.0 makes this an urgent patch-first issue.

What it is

CWP (Control Web Panel, formerly CentOS Web Panel) 7 before 0.9.8.1147 passes the login parameter in login/index.php to a shell without sanitizing shell metacharacters, allowing OS command injection. Because the flaw sits in the pre-authentication login handler, any network-reachable panel is exposed to remote code execution as the web server user.

Impact

An unauthenticated attacker can execute arbitrary operating system commands on the panel host, leading to full server compromise, data theft, and use of the host as a foothold for lateral movement. CVSS 3.1 base score is 9.8 (critical) with high confidentiality, integrity, and availability impact.

Attack surface

Reached over the network via HTTP requests to login/index.php with crafted shell metacharacters in the login parameter. The CVSS vector (AV:N/AC:L/PR:N/UI:N) and the description both indicate no authentication and no user interaction are required.

Exploitation

CVE-2022-44877 is listed in CISA KEV (added 2023-01-17, due 2023-02-07) and has an EPSS 30-day probability of 0.99995 (percentile 0.99988). Multiple public references are tagged Exploit, including Packet Storm and Full Disclosure postings, so working exploit code is publicly available; KEV notes no known ransomware campaign use.

What to do

• Upgrade CWP to 0.9.8.1147 or later immediately; this is the vendor fix for the flaw.
• If patching cannot be done at once, restrict access to the CWP login interface (ports 2030/2031 or the configured panel port) to trusted management IPs only.
• Place the panel behind a VPN or authenticated reverse proxy so the login endpoint is not internet-exposed.
• Rotate credentials and review the host for unauthorized accounts, cron jobs, SSH keys, and web shells after any suspected exposure.
• Monitor vendor and CISA KEV guidance for this CVE and confirm the running version after remediation.

Detection

• Inspect web server and panel logs for requests to login/index.php containing shell metacharacters (;, |, $(), `, &&) in the login parameter.
• Alert on unexpected child processes spawned by the web server or panel service (for example sh, bash, curl, wget, nc) using process monitoring or EDR.
• Hunt for outbound connections or new files/accounts created shortly after panel login requests, which may indicate post-exploitation activity.
• Check for the presence of known public exploit payload patterns from the referenced Packet Storm and Full Disclosure postings in HTTP request logs.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.