← CVE Radar
CVE-2026-77880Control Web Panel (CWP) < 1.16 OS Command Injection via /newpass/
Control Web Panel (CWP) before webpanel_version 1.16 contains an OS command injection vulnerability in the loopback API password change route /newpass/, which runs as root. An attacker can inject arbitrary OS commands by manipulating the POST 'user' parameter that is passed unescaped into a shell command, achieving remote code execution with root privileges.
8.5 HIGHEPSS 0.78%Not in KEVNVD: Deferred
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 8.5 | HIGH | 4.0VulnCheck (CNA) | CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N |
| 7.8 | HIGH | 3.1VulnCheck (CNA) | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Details
- CVE ID
- CVE-2026-77880
- Status
- Deferred
- Assigner (CNA)
- VulnCheck
- Published
- Nov 2, 2026
- Last modified
- 2026-11-03 17:18 UTC
- Weaknesses
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
As published by the CNA in the CVE record.
Control Web PanelControl Web Panel1 version range
- before 1.16