CWP authentication bypass enables unauthenticated RCE
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Unauthenticated remote code execution in CentOS Web Panel via command injection requires immediate patching of versions before 0.9.8.1205.
CentOS Web Panel (CWP) before version 0.9.8.1205 contains a critical authentication bypass vulnerability that allows unauthenticated remote code execution. The flaw exists in the filemanager changePerm request handler, where shell metacharacters in the t_total parameter trigger command injection, bypassing normal authentication requirements. An attacker only needs to know a valid non-root username to exploit this vulnerability. The admin interface, typically accessible on ports 2087 or 2031 over HTTPS, is designed for system administrators managing web servers, DNS, email, and security configurations. Proof-of-concept code is publicly available, indicating active exploitation risk. Organizations running CWP on Linux-based systems must immediately update to the patched version after testing, implement network segmentation to restrict access to the admin interface, and review access logs for signs of exploitation.
Mentioned in this report
Detection guidance
CWP Filemanager changePerm Request With Shell Metacharacters in t_total
Web request to the CWP filemanager changePerm handler where the t_total parameter carries shell metacharacters, indicating command injection (authentication bypass RCE). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: CWP Filemanager changePerm Request With Shell Metacharacters in t_total
description: Detects requests to the CentOS Web Panel filemanager changePerm handler
where the t_total parameter contains shell metacharacters or command substitution
(raw or URL-encoded). Matches the injection pattern, not a specific payload. Only
works where the query string is logged; POST bodies are not visible.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.t1059
logsource:
category: webserver
detection:
selection_handler:
cs-uri|contains|all:
- changePerm
- t_total
selection_meta:
cs-uri|contains:
- t_total=%3B
- t_total=%7C
- t_total=%26
- t_total=%60
- t_total=%24%28
- t_total=%24(
- t_total=;
- t_total=|
- t_total=&
- t_total=`
- t_total=$(
- '%3B'
- '%60'
- '%24%28'
- $(
condition: selection_handler and selection_meta
falsepositives:
- Vulnerability scanners run by the owning organisation against the CWP admin interface
level: high
id: 8c00ba43-2dd4-5c5f-b5eb-82353576169a
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-cwp-aka-control-web-panel-or-centos-web-panel-could-allow-for-remote-code-execution_2025-100
CWP Web Server Process Spawning Shell or Download Utility
The CWP admin web server process (cwpsrv) spawning a shell, which is consistent with command injection through the filemanager handler. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: CWP Web Server Process Spawning Shell or Download Utility
description: Detects the CentOS Web Panel admin web server (cwpsrv) spawning a shell
or common download/reverse-shell utility, which is consistent with exploitation
of the unauthenticated filemanager command injection.
tags:
- attack.execution
- attack.t1059.004
- attack.initial-access
- attack.t1190
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains: cwpsrv
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /curl
- /wget
- /nc
- /ncat
- /python
- /python3
- /perl
condition: selection_parent and selection_child
falsepositives:
- CWP built-in admin functions that legitimately shell out for chmod or file operations
through sh
- Administrator-initiated CWP maintenance tasks invoked from the panel
level: medium
id: 3089f80f-473d-5cba-96e3-07f36324ec8a
status: experimental
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-cwp-aka-control-web-panel-or-centos-web-panel-could-allow-for-remote-code-execution_2025-100
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-cwp-aka-control-web-panel-or-centos-web-panel-could-allow-for-remote-code-execution_2025-100
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs