Actively exploited · CISA KEV · NVD published 2023-01-05
Actively exploitedCVE-2022-44877
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
- First PoC
- 992 days →Metasploit
- 304 days →First cited attacker
Signals
- Exploited in the wild
- Yesadded 2023-01-17 · due 2023-02-07. An observation, not a forecast.
- EPSS · 30-day forecast
- 100.0%Chance of exploitation in the next 30 days, 100th percentile of all CVEs. A forecast; KEV outranks it.
- CVSS · NVD · CRITICAL
- 9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Internet exposure
- not stated by sourcesNo exposure census on this CVE's dispatches.
Exploits
4 known · links onlyMetasploit1
Control Web Panel versions < 0.9.8.1147 are vulnerable to unauthenticated OS command injection. Successful exploitation results in code execution as the root user. The results of the command are not contained within the HTTP response and the request will block while the command is running.
ruby · seen 2026-10-18
Exploit-DB2
created 2023-04-01
created 2023-04-05
Nuclei1
CentOS Web Panel 7 before 0.9.8.1147 is susceptible to remote code execution via entering shell characters in the /login/index.php component. This can allow an attacker to execute arbitrary system commands via crafted HTTP requests and potentially execute malware, obtain sensitive information, modify data, and/or gain full control over a compromised system without entering necessary credentials.
yaml · seen 2026-10-18
Detections
3 rules · Sigma · QRadar · CortexGenerated by skopnix from this finding, each with false-positive notes. Open the list →
On the wire
0 dispatchesNo dispatch on our wire has named this CVE yet.
Watch this one?
KEV additions reach Telegram and the KEV-only RSS as they land.
Check your stack
Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.
Stack checkNo key. No signup.