What is CVE-2023-42122?

CVE-2023-42122 is a high-severity vulnerability in Control Web Panel, classified under OS Command Injection. CVSS score: 7.8/10. Published 2024-05-03.

How severe is CVE-2023-42122?

High severity. CVSS v3 base score is 7.8 out of 10.

RCE in Control Web Panel

CVE-2023-42122

Control Web Panel wloggui Command Injection Local Privilege Escalation Vulnerability. This vulnerability allows local attackers to escalate privileges on affected installations of Control Web Panel. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists within the cwpsrv process, which listens on the loopback interface. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to escalate privileges and execute arbitrary code in the context of root. Was ZDI-CAN-21079.

Vulnerability class: Command Injection (OS Command Injection)

EPSS: 0.007 (49.9th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 7.8 (High). Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.

Affected products

Control Web Panel — versions 0.9.8.1152
Control-webpanel Webpanel — versions 0.9.8.1152

Weakness classification (CWE)

CWE-78 — OS Command Injection

References

zdi-disclosures@trendmicro.com (x_research-advisory, Third Party Advisory)

Frequently asked questions

What is CVE-2023-42122?: CVE-2023-42122 is a high-severity vulnerability in Control Web Panel, classified under OS Command Injection. CVSS score: 7.8/10. Published 2024-05-03.
How severe is CVE-2023-42122?: High severity. CVSS v3 base score is 7.8 out of 10.