Control Web Panel user panel flaws allow remote code execution and root takeover
Anyone can get into a website server control program and run commands.
Summary
Several flaws in the Control Web Panel user panel let an unauthenticated attacker run commands and reach root on the server. Servers with the user panel on port 2083 open to the internet are affected.
Affected when
- User panel on port 2083 reachable from the internet
What to do
Update to 1.29 or later (1.30 is the current release). Until then, do not leave the admin page open to the internet.
Products and platforms
CVE IDs
Sources
- Advisory: control-webpanel.com (opens in a new tab)
- Write-up: vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab) · vulncheck.com (opens in a new tab)
- CVE record: cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab) · cve.org (opens in a new tab)
Times
First published
First seen