CVE-2022-44877
CWP Control Web Panel OS Command Injection Vulnerability
Description
CVE-2022-44877 is a critical OS command injection vulnerability in CWP (Control Web Panel, formerly CentOS Web Panel) 7 prior to version 0.9.8.1147. The flaw exists in the login page (login/index.php), where the login parameter fails to properly sanitize user-supplied input, allowing remote attackers to inject and execute arbitrary operating system commands via shell metacharacters. Because no authentication is required and the attack is network-based, any internet-facing CWP installation running a vulnerable version is at immediate risk of full server compromise. This vulnerability has been added to CISA's Known Exploited Vulnerabilities catalog, and with an EPSS score of 94.5% (99.99th percentile), CVE-2022-44877 is among the most actively targeted vulnerabilities in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| control-webpanel | webpanel | < 0.9.8.1147 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://seclists.org/fulldisclosure/2023/Jan/1(Exploit, Mailing List, Third Party Advisory)
- https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386(Exploit, Third Party Advisory)
- https://www.youtube.com/watch?v=kiLfSvc1SYY(Exploit, Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44877(US Government Resource)
Weakness Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-78 describes a weakness where an application constructs OS commands using user-controlled input without adequate neutralization of special characters. In the case of Control Web Panel, the login parameter in login/index.php is passed directly into a system command context, enabling attackers to append shell metacharacters and execute arbitrary commands on the underlying server with the privileges of the web server process.
Learn more: CWE-78 — OS Command Injection
Impact Analysis
CVE-2022-44877 carries a CVSS v3.1 score of 9.8 (Critical), reflecting its severe exploitability profile. The vulnerability is remotely exploitable over the network without requiring physical access to the target system. Attack complexity is low, meaning no special conditions or preparation are needed to launch an exploit. No authentication or privileges are required, allowing any anonymous attacker to target vulnerable CWP instances. No user interaction is needed, making exploitation fully automatable. Confidentiality, integrity, and availability impacts are all rated high — a successful exploit grants the attacker complete control over the server, enabling data theft, system modification, and denial of service. With an EPSS score of 94.5%, exploitation activity is near-certain, and organizations running unpatched CWP installations face critical risk of full server takeover.
Exploit Maturity
Public exploit code is widely available for CVE-2022-44877, with multiple proof-of-concept exploits published on Packet Storm Security, including both authenticated and unauthenticated variants. A detailed exploit walkthrough was also published on Full Disclosure, and a video demonstration is available on YouTube. CISA has confirmed active exploitation of this vulnerability in the wild by adding it to the Known Exploited Vulnerabilities catalog with a remediation deadline of February 7, 2023. The EPSS score of 94.5% (99.99th percentile) indicates near-certain ongoing exploitation activity, making immediate patching essential for any organization running Control Web Panel.
Remediation
- Apply the vendor patch immediately. Upgrade Control Web Panel (CWP) 7 to version 0.9.8.1147 or later, which addresses the OS command injection vulnerability in login/index.php. As stated in the KEV required action: apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- Restrict network access to the CWP login interface. Place the CWP administration panel behind a VPN or firewall and limit access to trusted IP addresses only. Do not expose the CWP login page directly to the public internet.
- Deploy a Web Application Firewall (WAF) rule to detect and block requests containing shell metacharacters (such as semicolons, backticks, pipes, and dollar-sign parentheses) in the login parameter as an interim mitigation while patching is in progress.
- Review server logs for indicators of compromise. Examine web server access logs for unusual POST requests to login/index.php with suspicious characters in the login field. Check for unauthorized processes, new user accounts, cron jobs, or web shells that may indicate prior exploitation.
- Implement input validation and command injection defenses. As a long-term hardening measure, ensure all user-supplied input passed to OS commands is properly sanitized using allowlists, and avoid constructing shell commands from user input wherever possible.
Technical Details
CVE-2022-44877 is rooted in improper neutralization of special elements used in an OS command (CWE-78). The vulnerable endpoint, login/index.php in Control Web Panel 7, accepts a login parameter that is incorporated into an operating system command without adequate sanitization of shell metacharacters. Attack vector is network-based (AV:N), meaning the vulnerability can be triggered by sending a crafted HTTP request to the CWP login page from anywhere on the internet. Attack complexity is low (AC:L), as exploitation requires only a simple HTTP POST request with shell metacharacters embedded in the login field — no race conditions or special configurations are necessary. No privileges are required (PR:N) and no user interaction is needed (UI:N), making the attack fully unauthenticated and automatable. The injected commands execute with the privileges of the web server process, typically resulting in complete server compromise with high impact to confidentiality, integrity, and availability (C:H/I:H/A:H).
Frequently Asked Questions
Is CVE-2022-44877 being actively exploited?
Yes, CVE-2022-44877 is actively exploited in the wild. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 7, 2023. The EPSS score of 94.5% (99.99th percentile) confirms that exploitation activity is near-certain, and multiple public exploits are readily available.
What products are affected by CVE-2022-44877?
CVE-2022-44877 affects CWP (Control Web Panel, formerly known as CentOS Web Panel) 7 in all versions prior to 0.9.8.1147. Any installation of Control Web Panel 7 running an older version that exposes the login interface is vulnerable to remote OS command injection.
How do I fix CVE-2022-44877?
Upgrade Control Web Panel 7 to version 0.9.8.1147 or later immediately. If upgrading is not possible, restrict access to the CWP login page using firewall rules or a VPN, and deploy WAF rules to block shell metacharacters in the login parameter. See the Remediation section for detailed steps.
How severe is CVE-2022-44877?
CVE-2022-44877 is rated Critical with a CVSS v3.1 score of 9.8 out of 10. It requires no authentication, no user interaction, and can be exploited remotely with low complexity. The EPSS score places it in the 99.99th percentile for exploitation likelihood, making it one of the most dangerous vulnerabilities currently tracked.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.