CVE-2022-44877
CWP Control Web Panel OS Command Injection Vulnerability
- Published
- Jan 5, 2023
- Updated
- Oct 21, 2025
- Assigning CNA
- mitre
- Evidence observed
- Jan 17, 2023
Primary CVSS
nvd · CVSS 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HHigh · next 30 days
- Percentile
- 100.0%
- Model date
- Oct 17, 2026
EPSS is a statistical estimate, not a certainty or a measure of impact. Combine it with CVSS, KEV status, exposure and your environment.
CISA Known Exploited
This CVE appears in the CISA Known Exploited Vulnerabilities catalog.
Summary
login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter.
Sources
modules/exploits/linux/http/control_web_panel_login_cmd_exec.rb
Metasploit Framework modulesDeclared conditions
- platform: Linux,Unix($.exploit_linux/http/control_web_panel_login_cmd_exec.platform)
- verification: check_declared($.exploit_linux/http/control_web_panel_login_cmd_exec.check)
http/cves/2022/CVE-2022-44877.yaml
Nuclei TemplatesDeclared conditions
- network: http($.protocol_keys)
- verification: status,word($.matchers[*].type)
- oob: interactsh_reference($.template_text)
- CVE-2022-44877Exploit
Bash script to detect and exploit CVE-2022-44877 command injection vulnerability in CentOS Web Panel, supporting single URL scanning, exploitation, and mass scanning from file or pipe.
- CVE-2022-44877Exploit
Proof-of-concept exploit for CVE-2022-44877, an unauthenticated remote code execution in Centos Web Panel 7 (< 0.9.8.1147) via command injection in the login parameter.
- CVE-2022-44877-white-boxExploit
Red Team utilities for setting up CWP CentOS 7 payload & reverse shell (Red Team 9 - CW2023)
Control Web Panel 7 (CWP7) Remote Code Execution (RCE) (CVE-2022-44877) (Unauthenticated)
- CVE-2022-44877Exploit
Go-based exploit for CVE-2022-44877 targeting CWP CentOS Web Panel, leveraging the go-exploit framework for modular exploitation and payload delivery.
- CVE-2022-44877-RCEExploit
numan türle · linux · Apr 1, 2023
Mayank Deshmukh · php · Apr 5, 2023
Responsible use
Use vulnerability information only on systems you own or are authorized to test. Kitploit links to public research metadata and does not store exploit code or malicious payloads.