virus logo FortiClient Vulnerability

Security Vulnerabilities fixed in Control Web Panel 0.9.8.1147

description-logoDescription

login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.

description-logoOutbreak Alert

A command injection vulnerability that allows remote attackers to easily exploit CWP (Control Web Panel) with a crafted HTTP request which can result in Remote Code Execution. According to Shodan, there are thousands of servers that could still be vulnerable to CVE-2022-44877. This vulnerability can be leveraged to perform ransomware attacks or exfiltration of data.

View the full Outbreak Alert Report

affected-products-logoAffected Applications

Control Web Panel

CVE References

CVE-2022-44877

Other References

https://nvd.nist.gov/vuln/detail/CVE-2022-44877
ID 4716
Created Jan 12, 2023
Description
Updated		 Nov 09, 2023
Outbreak Alert CWP OS Command Injection
Risk black-background-circle-icon black-background-circle-icon black-background-circle-icon black-background-circle-icon black-background-circle-icon
Coverage FortiClient
OS Linux
Vendor Control Web Panel
Patch manual
Application Control Web Panel