CVE-2020-15420

CRITICAL

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. Authentication is not required to exploit this vulnerability. T...

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS8.1%
Percentile95th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-78
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-6 Argument Injection
via CWE-78
CAPEC-15 Command Delimiters
via CWE-78
CAPEC-88 OS Command Injection
via CWE-78

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in CentOS Web Panel cwp-e and cwp-el7-0.9.8.891 allows remote attackers to execute arbitrary code without authentication due to improper validation of user-supplied input in loader_ajax.php.

BSID: BS-2020-GLOBAL-181836-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-15420?
A critical vulnerability in CentOS Web Panel cwp-e and cwp-el7-0.9.8.891 allows remote attackers to execute arbitrary code without authentication due to improper validation of user-supplied input in loader_ajax.php.
What is the CVSS score for CVE-2020-15420?
CVE-2020-15420 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 8.1%.
Is CVE-2020-15420 actively exploited?
No confirmed active exploitation of CVE-2020-15420 as of 2026-09-25.
How do I remediate CVE-2020-15420?
Priority: IMMEDIATE.
What systems are affected by CVE-2020-15420?
CVE-2020-15420 affects Control-Webpanel Webpanel.
Vulnerability Details
CVE IDCVE-2020-15420
BSIDBS-2020-GLOBAL-181836-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2020-07-28
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
OS Command Injection
SourceNVD
Official Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-el7-0.9.8.891. Authentication is not required to exploit this vulnerability. The specific flaw exists within loader_ajax.php. When parsing the line parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9259.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability exists in the loader_ajax.php file where the 'line' parameter is not properly validated before being used in a system call, enabling remote code execution.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Control-Webpanel Webpanel 0.9.8.891
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2270 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash78d30a3381a71563296371c4731ede4020686cf90dd0b7c2b30d8532d8d24aebc53fab7cd1b9ffbcb0b3556561499150a3eb34e0b8018281bae432abf7ac6bf0
Related CVEs affecting Control-Webpanel
CVE-2020-15421 9.8 This vulnerability allows remote attackers to execute arbitrary code on affec... CVE-2018-18322 9.8 CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injectio... CVE-2019-13360 9.8 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers... CVE-2020-10230 9.8 CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQ... CVE-2020-15422 9.8 This vulnerability allows remote attackers to execute arbitrary code on affec...
View all Control-Webpanel CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →