CVE-2020-15608: 
Control Web Panel vulnerability analysis and mitigation

A critical remote code execution vulnerability was identified in CentOS Web Panel, tracked as CVE-2020-15608. The vulnerability was discovered in the ajax_dashboard.php component and was publicly disclosed on June 25, 2020. This security flaw affects installations of CentOS Web Panel and does not require authentication to exploit (ZDI Advisory).

The vulnerability exists within ajax_dashboard.php when parsing the ai_service parameter. The process fails to properly validate user-supplied strings before using them in system calls. The vulnerability has been assigned a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H), indicating critical severity (ZDI Advisory).

Successful exploitation of this vulnerability allows attackers to execute arbitrary code in the context of root on affected CentOS Web Panel installations. The high CVSS score reflects the severe potential impact on system confidentiality, integrity, and availability (ZDI Advisory).

The vulnerability requires no authentication to exploit and can be triggered remotely. The Zero Day Initiative disclosed this vulnerability as a zero-day, indicating no patch was available at the time of disclosure (ZDI Advisory).

The recommended mitigation strategy is to restrict interaction with the service to trusted machines only. Organizations should implement firewall rules and whitelisting to ensure that only clients and servers with legitimate procedural relationships can communicate with the service (ZDI Advisory).

The vulnerability was initially reported to the vendor on January 28, 2020. After multiple status update requests and no response from the vendor, Zero Day Initiative proceeded with public disclosure on June 25, 2020, following their 120-day disclosure deadline policy (ZDI Advisory).