CVE-2025-48703
CWP Control Web Panel OS Command Injection Vulnerability
Description
CVE-2025-48703 is a critical OS command injection vulnerability in Control Web Panel (CWP, formerly CentOS Web Panel) versions before 0.9.8.1205, carrying a CVSS v3.1 score of 9.0. The flaw allows unauthenticated remote attackers to execute arbitrary operating system commands by injecting shell metacharacters into the t_total parameter of a filemanager changePerm request, provided a valid non-root username is known. This vulnerability is listed in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of November 25, 2025. The EPSS score of 0.59105 (98.2nd percentile) indicates an extremely high probability of active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| control-webpanel | webpanel | < 0.9.8.1205 |
References
- https://fenrisk.com/rce-centos-webpanel(Exploit, Third Party Advisory)
- https://control-webpanel.com/changelog(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703(US Government Resource)
Weakness Type
CWE-78: OS Command Injection
CWE-78 describes a vulnerability where an application constructs an operating system command using user-supplied input without properly neutralizing special elements such as shell metacharacters. In CVE-2025-48703, the CWP file manager's permission change functionality passes the t_total parameter directly into a shell command without sanitizing characters like semicolons, backticks, pipes, or dollar signs. This allows an attacker to append arbitrary OS commands that execute with the privileges of the web server process.
Impact Analysis
The business impact of CVE-2025-48703 is extremely severe due to the combination of remote code execution on a server management panel and the near-trivial exploitation requirements. Confidentiality and integrity are critically impacted because command execution on a CWP server grants access to all hosted websites, databases, email accounts, and system configurations managed through the panel. Availability is also at high risk since an attacker can disrupt all services managed by CWP.
The Changed Scope in the CVSS vector is particularly important — it indicates that exploiting CWP can affect resources beyond the vulnerable component itself, including the underlying operating system, hosted websites, and all user accounts managed through the panel. CWP is typically used on shared hosting servers managing multiple customer websites, meaning a single successful exploit can compromise dozens or hundreds of independent websites and their associated databases. The EPSS score of 0.59105 (98.2nd percentile) confirms widespread exploitation activity, and the fact that exploitation requires only knowledge of a valid non-root username (which is often predictable or enumerable on shared hosting systems) makes the attack highly practical. Ransomware association is listed as unknown, but web hosting control panels are prime targets for ransomware operators who can encrypt entire hosting environments affecting multiple customers simultaneously.
Exploit Maturity
CVE-2025-48703 has been confirmed as actively exploited in the wild with a public exploit and detailed writeup available. CISA KEV status: Added to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of November 25, 2025. EPSS context: The score of 0.59105 (98.2nd percentile) reflects extremely high exploitation activity, ranking this among the most actively exploited vulnerabilities in the current threat landscape.
Public exploit: Fenrisk has published a detailed vulnerability writeup and exploit demonstrating unauthenticated remote code execution against CWP installations. The availability of a complete exploit writeup with technical details significantly lowers the barrier to exploitation. Ransomware association: Currently listed as unknown, but the ability to execute operating system commands on shared hosting servers makes this an attractive target for both ransomware deployment and website defacement campaigns.
Remediation
-
Update CWP immediately — Upgrade Control Web Panel to version 0.9.8.1205 or later, which patches the command injection vulnerability. Review the CWP changelog for the specific security fix and follow the panel's built-in update mechanism.
-
Restrict access to the CWP management interface — Implement IP-based access restrictions on the CWP management ports (typically 2030, 2031, and 2086/2087) to limit access to trusted administrator IP addresses only. Use firewall rules (iptables, firewalld, or CSF) to block public access to these ports.
-
Audit server for compromise — If your CWP installation has been running an unpatched version, assume potential compromise and perform a thorough investigation. Check for unauthorized cron jobs, unfamiliar SSH keys in /root/.ssh/authorized_keys and user home directories, modified system binaries, and unexpected network connections.
-
Review and rotate credentials — Change all CWP administrative passwords, database passwords, and FTP/SSH credentials for all hosted accounts. If command execution was achieved, the attacker may have extracted credentials from configuration files.
-
Implement a Web Application Firewall — Deploy a WAF rule in front of CWP that blocks requests containing shell metacharacters in the t_total parameter and other file manager parameters. This provides defense-in-depth while ensuring the patch is applied.
Technical Details
The CVSS v3.1 vector for CVE-2025-48703 is AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, resulting in a critical score of 9.0. Attack Vector (Network) means the vulnerability is remotely exploitable over HTTP/HTTPS. Attack Complexity (High) reflects the requirement to know a valid non-root username on the target system, which adds a reconnaissance step but is often achievable through enumeration or educated guessing. Privileges Required (None) confirms no authentication is needed. The critical Scope (Changed) metric indicates that compromising CWP allows the attacker to affect the underlying operating system and all hosted resources.
The attack mechanism targets the CWP file manager's changePerm functionality, which handles file permission changes for hosted user accounts. The t_total parameter, intended to carry a numerical value representing the total number of files, is incorporated into a shell command executed by CWP's backend without proper sanitization of shell metacharacters. An attacker can inject characters such as semicolons (;), backticks (`), pipe operators (|), or command substitution syntax ($()) to append arbitrary OS commands. The prerequisite of knowing a valid non-root username is a minor obstacle — shared hosting environments typically have predictable usernames based on domain names or common patterns, and CWP installations may expose username information through various enumeration vectors. The injected commands execute with the privileges of the CWP web server process, which on most installations runs with sufficient privileges to access all hosted content, modify system configurations, and potentially escalate to root through local vulnerabilities or misconfigurations common on CWP servers.
Frequently Asked Questions
What is CVE-2025-48703?
CVE-2025-48703 is a critical remote code execution vulnerability in Control Web Panel (CWP, formerly CentOS Web Panel) that allows unauthenticated attackers to execute arbitrary operating system commands through shell metacharacter injection in the file manager's permission change functionality. The only prerequisite is knowing a valid non-root username on the server.
Is there a public exploit available?
Yes, Fenrisk has published a detailed vulnerability writeup and working exploit demonstrating how to achieve unauthenticated remote code execution against vulnerable CWP installations. This significantly increases the risk of exploitation by a wide range of attackers.
What is the potential impact of exploitation?
Successful exploitation grants the attacker OS-level command execution on the hosting server. On a typical CWP installation managing multiple websites, this means all hosted websites, databases, email accounts, and system configurations can be accessed, modified, or destroyed. The Changed Scope designation in the CVSS score reflects this cascading impact.
How can I check if my CWP version is vulnerable?
All versions of CWP before 0.9.8.1205 are vulnerable. You can check your current version in the CWP admin panel dashboard or by checking the CWP version file on the server. Update immediately through the panel's built-in update mechanism if your version is below 0.9.8.1205.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.