ACTIVELY EXPLOITED
CVE-2022-44877: CWP Control Web Panel OS Command Injection Vulnerability
| Vendor | CWP |
|---|---|
| Product | Control Web Panel |
| Actively exploited | Yes |
| Added to CISA KEV | 17 Jan 2023 |
| CISA federal deadline | 7 Feb 2023 |
| Weakness (CWE) | CWE-78 |
Required action (CISA's text)
Apply updates per vendor instructions.
Description (NVD)
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command injection vulnerability that allows remote attackers to execute commands via shell metacharacters in the login parameter.
SOURCES
Other CWP flaws
Data from NVD, CISA KEV, FIRST EPSS and vendor advisories. Updated 10 Nov 2026.