Control Web Panel flaws let unauthenticated requests reach root
VulnCheck disclosed ten vulnerabilities in Control Web Panel (CWP), including an unauthenticated chain that reaches root-level code execution.
The panel redirects unauthenticated requests to the login page but keeps processing them, allowing a request to load a module file chosen by the attacker. From there, flaws in a root-owned local API provide routes to command execution as root. A panel foothold can therefore become control of the server, not just access to its web interface.
VulnCheck tested the chain on a CWP build that already included the fix for the earlier KEV-listed RCE; all ten flaws are fixed in CWP 1.29. For hosting providers, a compromised panel can put the services and customer sites it administers within reach, and the earlier patch alone did not close this exposure.
CWP2Shell: The Login Page That Never Says No | Blog | VulnCheck
VulnCheck's Initial Access Intelligence team details an unauthenticated pre-auth remote root RCE chain in Control Web Panel, where the user panel emits its login redirect without stopping execution, so an attacker-named module file runs before authentication and a root-owned user API turns that foothold into uid 0.