Control Web Panel flaws let unauthenticated requests reach root
VulnCheck disclosed ten vulnerabilities in Control Web Panel (CWP), including an unauthenticated chain that reaches root-level code execution.
The panel redirects unauthenticated requests to the login page but keeps processing them, allowing a request to load a module file chosen by the attacker. From there, flaws in a root-owned local API provide routes to command execution as root. A panel foothold can therefore become control of the server, not just access to its web interface.
VulnCheck tested the chain on a CWP build that already included the fix for the earlier KEV-listed RCE; all ten flaws are fixed in CWP 1.29. For hosting providers, a compromised panel can put the services and customer sites it administers within reach, and the earlier patch alone did not close this exposure.
VulnCheck's Initial Access Intelligence team details an unauthenticated pre-auth remote root RCE chain in Control Web Panel, where the user panel emits its login redirect without stopping execution, so an attacker-named module file runs before authentication and a root-owned user API turns that foothold into uid 0.