Control Web Panel EUVD-2026-115247

The target must be running Control Web Panel at a version before webpanel_version 1.16. Exploitation requires sending a POST request to the loopback API route /newpass/ with attacker-controlled shell metacharacters in the 'user' parameter, which CWP concatenates unescaped into a shell command executed as root. The key limiting factor is reachability of that route: it is described as a loopback (localhost) API, and the supplied CVSS vector is AV:L, implying local/loopback access is normally required; however, the VulnCheck reference describes a 'pre-auth module dispatch' path that may expose it to remote unauthenticated attackers. No authentication is indicated (PR:N / pre-auth per the reference and vector), and no user interaction is required. Defenders should confirm whether their deployment exposes the dispatch mechanism that bridges external requests to the loopback endpoint, as that single factor determines whether this is local-only or remotely exploitable.

Signals are mixed but lean toward a genuine, near-term priority. The vulnerability is an OS command injection (CWE-78) in CWP's /newpass/ loopback API route that executes as root, yielding full root RCE - technical impact is total (VC:H/VI:H/VA:H). The vendor-supplied CVSS 4.0 vector is notably AV:L (local attack vector), consistent with the route being a loopback (localhost) API, yet the description and the VulnCheck reference title ('pre-auth module dispatch RCE') imply a remote, pre-authentication reachability path - likely a dispatch/SSRF-style mechanism that routes external requests to the loopback endpoint. This is a material conflict: AV:L says local-only, but the research framing suggests remote pre-auth exploitation, which would make real-world risk considerably higher. Verify the actual reachability with VulnCheck/vendor before down-rating on the AV:L metric alone. No EPSS score was provided, and the issue is not in CISA KEV, so there is no confirmation of active or widespread exploitation. A public PoC reference exists but is not verified as working exploit code. The vuln.today decision label is 'this_week', and a vendor patch is available. Net: treat as a high-urgency patch-this-week item given root impact, no-auth, a named researcher (VulnCheck), and an available fix - not merely a high-CVSS-but-low-real-risk issue - while acknowledging the local-vs-remote vector ambiguity is unresolved in the available data.

An attacker reaches the CWP loopback password-change route /newpass/ and submits a POST request with a crafted 'user' parameter containing shell metacharacters, which CWP passes unescaped into a root-level shell command. The injected commands execute as root, giving full server takeover. A public PoC reference (VulnCheck) exists but is not verified as working exploit code; the exact path by which a remote actor reaches the loopback route ('module dispatch') is described by the researcher but not detailed in the supplied data.