CVE-2026-77880

Summary

Control Web Panel (CWP) before version 1.16 has an OS command injection flaw in the /newpass/ loopback API route where the 'user' POST parameter is passed unescaped to a shell command, allowing unauthenticated remote code execution as root.

Exploitability

Exploitation requires network access to the vulnerable /newpass/ endpoint and knowledge of the loopback API's existence; no authentication is needed.

Blast radius

Successful exploitation grants full root-level control of the host, enabling complete system compromise, data theft, lateral movement, or persistence.

Detection

Look for POST requests to /newpass/ with shell metacharacters (e.g., ;, |, $(), backticks) or unexpected command-like strings in the 'user' parameter, especially from non-localhost sources or with abnormal request patterns; also monitor for subsequent root-level process execution or file modifications on the host.

Prioritized remediation

Upgrade to CWP webpanel_version 1.16 or later.

Analysis generated locally by garnet-coder (no data left the box). AI-assisted — verify against primary sources before acting.