{"id":"CVE-2026-77880","published":"2026-11-02T16:17:43.973","lastModified":"2026-11-02T19:35:33.347","description":"Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.","cvssScore":8.4,"cvssSeverity":"HIGH","cvssVector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":["CWE-78"],"vendors":[],"products":[],"references":[{"url":"https://control-webpanel.com/changelog","tags":[]},{"url":"https://www.vulncheck.com/advisories/control-web-panel-cwp-os-command-injection-via-newpass","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"Control Web Panel (CWP) before version 1.16 has an OS command injection flaw in the /newpass/ loopback API route where the 'user' POST parameter is passed unescaped to a shell command, allowing unauthenticated remote code execution as root.","exploitability":"Exploitation requires network access to the vulnerable /newpass/ endpoint and knowledge of the loopback API's existence; no authentication is needed.","blast_radius":"Successful exploitation grants full root-level control of the host, enabling complete system compromise, data theft, lateral movement, or persistence.","remediation":"Upgrade to CWP webpanel_version 1.16 or later.","detection":"Look for POST requests to /newpass/ with shell metacharacters (e.g., ;, |, $(), backticks) or unexpected command-like strings in the 'user' parameter, especially from non-localhost sources or with abnormal request patterns; also monitor for subsequent root-level process execution or file modifications on the host.","tags":["rce","command-injection","webapp","root-privileges","loopback-api"],"model":"garnet-coder","analyzedAt":"2026-11-03T10:02:24.966Z"}}