CVE entry · CVE-2025-48703
CVE-2025-48703: CWP Control Web Panel OS Command Injection Vulnerability
CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
- Actively exploited: added to CISA’s KEV catalog on November 4, 2025.
- Use by ransomware: not established so far.
- Remediation deadline for US federal agencies: November 25, 2025.
Description from CISA’s KEV catalog.
What to do
- Check whether your estate includes CWP Control Web Panel, including internet-facing devices.
- Apply the vendor’s patch or mitigations (references below). Failing that, isolate the product or stop using it, as CISA requires of US federal agencies.
- An exploited vulnerability has often been used before it was fixed: look for signs of compromise, especially on internet-facing devices.
References
- Vendor advisory or reference cited by CISA (control-webpanel.com)
- NVD entry (NIST)
- CISA KEV catalog