Platform
other
Component
control-web-panel
Fixed in
0.9.9
CVE-2023-42121 is a critical Remote Code Execution (RCE) vulnerability discovered in Control Web Panel. This flaw allows unauthenticated attackers to execute arbitrary code on vulnerable systems, potentially leading to complete system compromise. The vulnerability impacts Control Web Panel versions 0.9.8.1152–0.9.8.1152. A patch is available to address this issue.
The impact of CVE-2023-42121 is severe due to the lack of authentication required for exploitation. An attacker can directly access vulnerable endpoints and execute arbitrary code, effectively gaining control of the server hosting the Control Web Panel. This could lead to data breaches, malware installation, and complete system takeover. The absence of authentication significantly lowers the barrier to entry for attackers, increasing the likelihood of exploitation. Successful exploitation could allow attackers to modify system files, install backdoors, and pivot to other systems on the network, expanding the blast radius of the attack.
CVE-2023-42121 was disclosed on May 3, 2024. The vulnerability was reported to ZDI as ZDI-CAN-20582. Public proof-of-concept (PoC) code is likely to emerge given the ease of exploitation and the critical severity. The CVSS score of 9.8 indicates a critical vulnerability with a high probability of exploitation. It is recommended to prioritize patching this vulnerability.
Exploit Status
EPSS
1.17% (79% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2023-42121 is to immediately upgrade Control Web Panel to a patched version. Since a specific fixed version is not provided, consult the Control Web Panel vendor's website for the latest release. If upgrading is not immediately feasible, consider implementing temporary workarounds such as restricting network access to the Control Web Panel interface using a Web Application Firewall (WAF) or proxy server. Configure the WAF to block requests to potentially vulnerable endpoints. Monitor system logs for suspicious activity and unauthorized access attempts. After upgrade, confirm the vulnerability is resolved by attempting to access the vulnerable endpoint and verifying that access is denied.
Update Control Web Panel to a version later than 0.9.8.1152 that fixes the missing authentication remote code execution vulnerability. Refer to the vendor's website for the latest version and upgrade instructions.
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2023-42121 is a critical Remote Code Execution vulnerability in Control Web Panel versions 0.9.8.1152–0.9.8.1152, allowing attackers to execute code without authentication.
You are affected if you are running Control Web Panel version 0.9.8.1152–0.9.8.1152 and have not upgraded to a patched version.
Upgrade Control Web Panel to the latest available version. Consult the vendor's website for the latest release and patching instructions.
While active exploitation is not yet confirmed, the critical severity and ease of exploitation suggest a high likelihood of exploitation in the near future.
Refer to the Control Web Panel vendor's website and security advisories for the official announcement and details regarding CVE-2023-42121.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.