Security News > 2023 > January > Alert: Hackers Actively Exploiting Critical "Control Web Panel" RCE Vulnerability
Malicious actors are actively attempting to exploit a recently patched critical vulnerability in Control Web Panel that enables elevated privileges and unauthenticated remote code execution on susceptible servers.
Control Web Panel, formerly known as CentOS Web Panel, is a popular server administration tool for enterprise-based Linux systems.
"Login/index.php in CWP 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter," according to NIST. Gais Security researcher Numan Turle has been credited with discovering and reporting the flaw to the Control Web Panel.
"This is an unauthenticated RCE," Shadowserver said in a series of tweets, adding, "Exploitation is trivial."
GreyNoise said that it has observed four unique IP addresses attempting to exploit CVE-2022-44877 to date, two of which are located in the U.S. and one each from the Netherlands and Thailand.
This is not the first time similar flaws have been discovered in CWP. In January 2022, two critical issues were identified in the hosting panel that could have been weaponized to achieve pre-authenticated remote code execution.
News URL
https://thehackernews.com/2023/01/alert-hackers-actively-exploiting.html
Related news
- Hackers exploit critical Aviatrix Controller RCE flaw in attacks (source)
- Critical RCE Flaw in GFI KerioControl Allows Remote Code Execution via CRLF Injection (source)
- Hackers Exploit Aviatrix Controller Vulnerability to Deploy Backdoors and Crypto Miners (source)
- Critical SimpleHelp Flaws Allow File Theft, Privilege Escalation, and RCE Attacks (source)
- Critical Flaws in WGS-804HPT Switches Enable RCE and Network Exploitation (source)
- Web Cache Vulnerability Scanner: Open-source tool for detecting web cache poisoning (source)
- Cisco fixes ClamAV vulnerability with available PoC and critical Meeting Management flaw (source)
- Hackers exploit critical unpatched flaw in Zyxel CPE devices (source)
- Zyxel CPE devices under attack via critical vulnerability without a patch (CVE-2024-40891) (source)
- Lightning AI Studio Vulnerability Could've Allowed RCE via Hidden URL Parameter (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-01-05 | CVE-2022-44877 | OS Command Injection vulnerability in Control-Webpanel Webpanel login/index.php in CWP (aka Control Web Panel or CentOS Web Panel) 7 before 0.9.8.1147 allows remote attackers to execute arbitrary OS commands via shell metacharacters in the login parameter. | 9.8 |