Security readout for executives and security teams
Plain-English summary
CVE-2021-45466 is a critical flaw in CWP before 0.9.8.1107. An unauthenticated network attacker could make a crafted API request that writes an authorized_keys file under the web panel resources area, creating a serious risk of server takeover if the panel is exposed.
Executive priority
Treat this as urgent for any internet-facing CWP deployment. The issue is critical because it is remote, unauthenticated, and tied to file creation that could enable deeper compromise. Prioritize version verification, upgrade status, and exposure reduction.
Technical view
The CVE describes an incorrect authorization issue in CWP, also known as Control Web Panel or CentOS Web Panel. The reported behavior allows a crafted add_server API request involving DHCP handling to place an authorized_keys text file in /resources/. CVSS 3.1 rates it 9.8 with network attack vector and no required privileges or user interaction.
Likely exposure
Exposure is most likely where CWP versions before 0.9.8.1107 are reachable from untrusted networks. The CVE record does not provide structured CPEs or exact vendor metadata, so asset owners should verify installed CWP versions and public accessibility directly.
Exploitation context
The provided bundle does not show CISA KEV listing or confirmed active exploitation for CVE-2021-45466. However, the CVSS vector indicates remote, unauthenticated, low-complexity exploitation. One reference discusses related CWP pre-authentication RCE research, supporting that this product area has had severe pre-authentication issues.
Researcher notes
The CVE data is sparse: affected vendor/product fields are listed as n/a, and the public description is brief. The strongest grounded facts are the CWP version boundary, crafted API request behavior, CWE-863 classification, and CVSS 9.8 vector. Avoid assuming exploitation in the wild without additional evidence.
Mitigation direction
- Upgrade CWP to 0.9.8.1107 or later, guided by official vendor release notes.
- Restrict CWP administrative and API access to trusted management networks only.
- Check vendor guidance before applying compensating controls not documented in sources.
- Remove any unexpected authorized_keys files from CWP resource paths after investigation.
- Rotate credentials and keys if unauthorized file creation is suspected.
Validation and detection
- Inventory all CWP installations and record exact versions.
- Confirm whether any instance is older than 0.9.8.1107.
- Review web and panel logs for suspicious add_server or DHCP API activity.
- Inspect the CWP resources directory for unexpected authorized_keys files.
- Verify management interfaces are not exposed to the public internet.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-863: Authorization and privilege behavior lookup
Authorization weaknesses can support privilege escalation and valid-account review, depending on exploit path. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2021-45466 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Critical
- CVSS
- 9.8 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H3.95.9Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
9.8CriticalVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Source materials
- CVE List V5 sourceCVE List V5
- https://control-webpanel.com/changelogCVE reference
- https://octagon.net/blog/2022/01/22/cve-2021-45467-cwp-centos-web-panel-preauth-rce/CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Incorrect Authorization
Incorrect Authorization represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.