CVE-2020-15421

CRITICAL

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. T...

Affects 1 product across 1 vendor.

CVSS 3.19.8
EPSS8.1%
Percentile95th
PatchUnknown
CVSS Vector — Plain English Remotely exploitable over the network, low complexity, no authentication required, no user interaction needed, impact contained to the vulnerable component, full confidentiality impact, full integrity impact, full availability impact.
CWE Weakness Definitions
CWE-78: OS Command Injection

Attacker injects OS commands through application inputs passed to system() or equivalent calls, leading to arbitrary command execution.

Related Attack Patterns (CAPEC)
CAPEC-43 Exploiting Multiple Input Interpretation Layers
via CWE-78
CAPEC-108 Command Line Execution through SQL Injection
via CWE-78
CAPEC-6 Argument Injection
via CWE-78
CAPEC-15 Command Delimiters
via CWE-78
CAPEC-88 OS Command Injection
via CWE-78

Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.

◆ AI Analysis — automated analysis, not human-reviewed

A critical vulnerability in CentOS Web Panel cwp-e17.0.9.8.923 allows remote attackers to execute arbitrary code without authentication due to improper validation of the check_ip parameter in ajax_mod_security.php.

BSID: BS-2020-GLOBAL-146147-C • Model: /workspace/models/qwen2.5-coder-32b-instruct-bf16 • Confidence: HIGH

Is this CVE in your environment?

BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.

Check My Environment →
Frequently Asked Questions
What is CVE-2020-15421?
A critical vulnerability in CentOS Web Panel cwp-e17.0.9.8.923 allows remote attackers to execute arbitrary code without authentication due to improper validation of the check_ip parameter in ajax_mod_security.php.
What is the CVSS score for CVE-2020-15421?
CVE-2020-15421 has CVSS 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS: 8.1%.
Is CVE-2020-15421 actively exploited?
No confirmed active exploitation of CVE-2020-15421 as of 2026-09-25.
How do I remediate CVE-2020-15421?
Priority: IMMEDIATE.
What systems are affected by CVE-2020-15421?
CVE-2020-15421 affects Control-Webpanel Webpanel.
Vulnerability Details
CVE IDCVE-2020-15421
BSIDBS-2020-GLOBAL-146147-C BreachSpider Global ID
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Published2020-07-28
Last Modified2026-06-17
ICS Relevance15%
Weakness (CWE)
OS Command Injection
SourceNVD
Official Description

This vulnerability allows remote attackers to execute arbitrary code on affected installations of CentOS Web Panel cwp-e17.0.9.8.923. Authentication is not required to exploit this vulnerability. The specific flaw exists within ajax_mod_security.php. When parsing the check_ip parameter, the process does not properly validate a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of root. Was ZDI-CAN-9707.

Source: NIST NVD / MITRE CVE Database

Attack Vector Analysis — CITED Relevance

The vulnerability exists in the handling of the check_ip parameter in the ajax_mod_security.php script. An attacker can craft a malicious request to this script, leading to the execution of arbitrary system commands.

Exploitation Likelihood: CRITICAL

Affected Products
VendorProductAffected Versions
Control-Webpanel Webpanel 0.9.8.923
Remediation

No official vendor advisory link on record. See the CVE record →

Threat Intelligence
● Threat Intelligence Validated: October 2026 | Threat Age: 2270 Days
CISA known-exploitedNot in KEV catalog
Public ExploitNot confirmed
PoC CodeNot confirmed
AI Enrichment Record — provenance & audit hash
Model/workspace/models/qwen2.5-coder-32b-instruct-bf16
ConfidenceHIGH
Enriched At2026-05-24
SHA-512 Audit Hash132a8899cdbc5e99286a39c0bb01b56014164b5d6959cc04650bd70dd6f15546ff9a6d6aaa3e773f8622987caf47d096f4d0e2b03074da3c51483cbeb7371fdb
Related CVEs affecting Control-Webpanel
CVE-2020-15420 9.8 This vulnerability allows remote attackers to execute arbitrary code on affec... CVE-2018-18322 9.8 CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.480 has Command Injectio... CVE-2019-13360 9.8 In CentOS-WebPanel.com (aka CWP) CentOS Web Panel 0.9.8.836, remote attackers... CVE-2020-10230 9.8 CentOS-WebPanel.com (aka CWP) CentOS Web Panel (for CentOS 6 and 7) allows SQ... CVE-2020-15422 9.8 This vulnerability allows remote attackers to execute arbitrary code on affec...
View all Control-Webpanel CVEs →

Critical Severity - Know Your Exposure

A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.

Create a free account →