# CVE-2022-44877

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

- Page: https://www.vulneraibility.com/cve/CVE-2022-44877
- CVSS: 9.8
- Known exploited: yes, in CISA KEV since 2023-01-17; CISA due date 2023-02-07
- EPSS: 100.00% (percentile 100.0)
- Public exploit code: 2 on Exploit-DB · 1 Metasploit module · 8 GitHub proofs of concept · 1 Nuclei template (first 2023-01-05)
- CISA SSVC: exploitation active, automatable yes, technical impact total (assessed 2025-01-29)
- Weakness: CWE-78
- Published: 2023-01-05

## Affected

- control-webpanel:webpanel

## References

- [other] https://www.youtube.com/watch?v=kiLfSvc1SYY
- [other] https://gist.github.com/numanturle/c1e82c47f4cba24cff214e904c227386
- [other] http://seclists.org/fulldisclosure/2023/Jan/1
- [other] http://packetstormsecurity.com/files/170388/Control-Web-Panel-7-Remote-Code-Execution.html
- [other] http://packetstormsecurity.com/files/170820/Control-Web-Panel-Unauthenticated-Remote-Command-Execution.html
- [other] http://packetstormsecurity.com/files/171725/Control-Web-Panel-7-CWP7-0.9.8.1147-Remote-Code-Execution.html
- [other] https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-44877

---
Summary, impact and action are written by the vulneraibility.com AI analysis pipeline from the CVE record, NVD, CISA and FIRST data; verify against the references.