CVE DatabaseCVE-2025-48703

Updated 2026-06-17한국어 권고문 →

CVE-2025-487039.0/CRITICALCISA KEVCWE-78

Control Web Panel (CWP) Remote Code Execution Vulnerability Analysis and Mitigation Guide (CVE-2025-48703)

⚡ Jump to Patch

Affected Vendors

control-webpanel

Affected Components

control-webpanel, centos-web-panel

Published Date

2025-09-19

CVSS v3.1

9.0

CRITICAL

EPSS (30d)

99.7%

FIRST.org

CISA KEV

Exploited

NVD Source ↗

Executive & SecOps Summary

SECOPS ASSESSMENT

Affected Scope

Control Web Panel (CWP, formerly CentOS Web Panel) versions prior to 0.9.8.1205

Impact

Unauthenticated remote attackers can execute arbitrary code (RCE) on the target server by injecting shell metacharacters into the 't_total' parameter of a 'changePerm' request, provided a valid non-root username is known

Mitigation

Immediately upgrade CWP to version 0.9.8.1205 or higher, and restrict access to the CWP management ports using firewall rules

Affected Products & Version Scope

All Control Web Panel (CWP / CentOS Web Panel) versions prior to 0.9.8.1205

Remediation & Live Workaround Commands

PATCH & WORKAROUND

1. Official Patch & Version Upgrade Commands

Apply the official security update immediately to upgrade CWP to version 0.9.8.1205 or later. Run the following commands in your terminal to force the update:

bash

# Force update CWP via the official update script
sh /scripts/update_cwp

# Restart the CWP service and verify the installed version
service cwpsrv restart
cat /usr/local/cwpsrv/htdocs/resources/version.txt

2. Temporary Workaround & Hardening Configuration

If patching cannot be applied immediately, restrict access to CWP administrative ports (e.g., 2030, 2031, 2082, 2083, 2086, 2087) using firewalld to allow only trusted IP addresses.

bash

# Remove public access to CWP ports
firewall-cmd --permanent --zone=public --remove-port=2031/tcp
firewall-cmd --permanent --zone=public --remove-port=2083/tcp

# Allow access only from a trusted administrator IP (e.g., 192.168.1.100)
firewall-cmd --permanent --zone=trusted --add-source=192.168.1.100
firewall-cmd --permanent --zone=trusted --add-port=2031/tcp
firewall-cmd --permanent --zone=trusted --add-port=2083/tcp
firewall-cmd --reload

3. Log Audit & IoC Verification Commands

Inspect the CWP web server access logs for suspicious changePerm requests containing shell metacharacters or command execution patterns.

bash

# Search for suspicious changePerm requests in CWP access logs
grep -i 'changePerm' /usr/local/cwpsrv/logs/access_log | grep -E '(\||;|\&|\`|\$)'

# Monitor active processes for suspicious child shells spawned by the CWP daemon
ps auxf | grep -E '(cwpsrv|nobody)' | grep -E '(sh|bash|curl|wget|python|perl)'

Interactive SecOps Remediation Checklist

0/4 (0%)

Recommended Security Control & Mitigation Partner

Cloudflare Enterprise & Pro WAF

As this vulnerability is actively exploited in the wild (CISA KEV), immediately update CWP to version 0.9.8.1205 or higher and restrict management port exposure.

Block Exploits Instantly with Managed Virtual Patching Rules

Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.

3-min setup · Automated Zero-Day Managed Rules

Deploy Instant WAF Protection Free

Practice Exploiting & Patching This Web Vulnerability in an Interactive Lab

Launch Hands-On Security Lab

Technical Root Cause & Exploitation Mechanics

1. Vulnerability Overview & Root Cause

This vulnerability (CVE-2025-48703) exists in Control Web Panel (CWP) due to improper sanitization of user-supplied input within the file manager's permission modification (changePerm) functionality. Specifically, the application fails to properly validate or escape shell metacharacters passed via the t_total parameter before executing system commands internally. This leads to an OS Command Injection vulnerability (CWE-78), allowing attackers to append malicious commands.

2. Exploitation Mechanics & Attack Scenario

An attacker who knows or has harvested a valid non-root username on the target CWP instance can craft a malicious HTTP POST request targeting the changePerm endpoint. By embedding shell metacharacters (such as ;, &, or |) followed by arbitrary commands inside the t_total parameter, the attacker forces the underlying CWP backend service to execute the payload with the privileges of the web server process, completely bypassing authentication requirements.

3. Infrastructure & Business Impact

With a CVSS score of 9.0 (Critical) and active exploitation confirmed by its inclusion in the CISA KEV catalog, this vulnerability poses an extreme risk to hosting providers and enterprise servers. Successful exploitation allows complete system compromise, enabling attackers to exfiltrate sensitive database credentials, deface hosted websites, deploy ransomware, or establish persistent backdoors within the internal network infrastructure.

Official Vendor Advisories & References

NVD Original English Description

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

https://fenrisk.com/rce-centos-webpanel

Source: cve@mitre.org · Exploit, Third Party Advisory

https://control-webpanel.com/changelog

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · Release Notes

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 · US Government Resource

Frequently Asked SecOps Questions (CVE-2025-48703)

FAQ

Q1. How critical is CVE-2025-48703 and is it actively exploited in the wild?

CVE-2025-48703 is rated CVSS 9.0 (CRITICAL) with a 30-day EPSS exploitation probability of 99.7%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.

Q2. Which vendors and products are affected by CVE-2025-48703?

Primary impacted vendors include control-webpanel across control-webpanel, centos-web-panel. Scope summary: All Control Web Panel (CWP / CentOS Web Panel) versions prior to 0.9.8.1205

Q3. What temporary mitigations or workarounds exist for CVE-2025-48703 before patching?

[Mitigation] Immediately upgrade CWP to version 0.9.8.1205 or higher, and restrict access to the CWP management ports using firewall rules Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.

SECOPS WORKBENCH INTEGRATION