PT-2026-135495
CVE-2026-77880
·
Published
2026-11-02
·
Updated
2026-11-02
Description by
CVSS 3.1
8.4
HighMetricsAV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Control Web Panel (CWP) before webpanel version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.
Exploitability
Exploit
Fix
Impacts
Researchers
Vendors
Affected products
Found an issue in the description? Have something to add? Feel free to write us 👾