CVE-2022-44877: CWP Control Web Panel OS Command Injection Vulnerability

Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2023-01-17. EPSS: 100% chance of exploitation in the next 30 days.

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

Affected products

• Control-Webpanel Webpanel: before 0.9.8.1147 (fixed in 0.9.8.1147)

Published 2023-01-05. Last modified 2026-06-17.