PT-2026-54885 · Unknown · Control Web Panel

Egidio Romano · Published 2026-07-01 · Updated 2026-07-03 · CVE-2026-57517

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Control Web Panel versions prior to 0.9.8.1225

Description An unauthenticated remote attacker can execute arbitrary SQL queries due to improper input validation and unsafe SQL query construction. This issue occurs at the 'user' endpoint through the userRes POST parameter. Approximately 896,400 devices worldwide are potentially affected. By exploiting MySQL root privileges, an attacker can use the INTO DUMPFILE command to write a PHP webshell into the web-accessible Roundcube logs directory, resulting in remote code execution as the cwpsvc account and potential full server compromise.

Recommendations Upgrade to version 0.9.8.1225. As a temporary mitigation, restrict access to the 'user' endpoint or avoid using the userRes parameter until the update is applied.

Exploit

Fix

RCE

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

CVE-2026-57517

Affected Products

Control Web Panel

References · 11

• 🔥 https://karmainsecurity.com/KIS-2026-12 · Exploit
• https://control-webpanel.com/changelog#1773753427572-9bf81bf4-f2d2 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2026-57517 · Security Note
• https://twitter.com/CCBalert/status/2072954567428382912 · Twitter Post
• https://twitter.com/the_yellow_fall/status/2072890069489164339 · Twitter Post
• https://t.me/CVEtracker/58589 · Telegram Post
• https://t.me/netlas/589 · Telegram Post
• https://vulncheck.com/advisories/control-web-panel-blind-sql-injection-via-userres-parameter · Note
• https://twitter.com/zoomeye_team/status/2072899981502042499 · Twitter Post
• http://seclists.org/fulldisclosure/2026/Jul/9 · Note
• https://twitter.com/UpwindMDR/status/2072368172879970598 · Twitter Post