Executive Summary

On November 5, 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-48703, a critical OS command injection vulnerability in Control Web Panel (CWP), to its Known Exploited Vulnerabilities (KEV) catalog. This action serves as a definitive warning that the vulnerability is under active attack by threat actors. The flaw, which can lead to unauthenticated remote code execution (RCE), affects a widely used free Linux web hosting management panel, putting countless servers at risk of complete compromise. In response, CISA has set a deadline of November 25, 2025, for U.S. federal agencies to apply patches. All other organizations using CWP are strongly advised to prioritize remediation immediately to prevent system takeover.

Vulnerability Details

CVE-2025-48703 is an OS command injection vulnerability in Control Web Panel (formerly CentOS Web Panel). It allows a remote attacker to execute arbitrary commands on the server with the privileges of the web server user.

The flaw exists in the file manager's changePerm endpoint. An attacker can inject shell metacharacters into the t_total parameter of an HTTPS POST request sent to this endpoint. While the endpoint requires authentication, researchers found that the authentication check could be bypassed if the attacker knows or can guess a valid, non-root username on the CWP instance. Since usernames like admin or the server's domain name are common, this prerequisite is often easy to meet.

Example of a malicious request body:

{
  "t_total": "';/usr/bin/id > /usr/local/cwpsrv/htdocs/resources/admin/modules/file_manager/test.txt;'"
}

This would execute the id command and write the output to a web-accessible file, confirming the RCE.

Affected Systems

• Control Web Panel (CWP) versions prior to 0.9.8.1205.

The patch was released in June 2025, but any server that has not been updated since then remains vulnerable.

Exploitation Status

This vulnerability is being actively exploited in the wild. CISA's addition of CVE-2025-48703 to the KEV catalog is based on concrete evidence of ongoing attacks. Threat actors are likely scanning the internet for vulnerable CWP instances to compromise them for use in botnets, crypto-mining operations, or as launch points for other attacks.

Impact Assessment

Successful exploitation of this vulnerability leads to a complete compromise of the web server. An attacker can:

• Host Malicious Content: Deface websites, host phishing pages, or distribute malware.
• Steal Data: Access and exfiltrate all data from the websites hosted on the server, including databases and user credentials.
• Gain a Foothold: Use the compromised server as a pivot point to attack other systems within the internal network.
• System Resource Abuse: Install crypto-miners or add the server to a botnet for DDoS attacks.

For web hosting providers, a single compromised CWP instance could lead to the breach of hundreds or thousands of their customers' websites.

Cyber Observables for Detection

Detection Methods

1. Web Application Firewall (WAF): Implement a WAF rule to inspect POST requests to the CWP file manager endpoint and block any that contain shell metacharacters in the t_total parameter. This is a form of D3-ITF: Inbound Traffic Filtering.
2. Log Analysis: Ingest CWP access logs into a SIEM and create alerts for POST requests to the vulnerable endpoint, especially if they originate from unusual IP addresses or occur in high frequency.
3. Vulnerability Scanning: Regularly scan public-facing assets with a vulnerability scanner to identify any servers running a vulnerable version of CWP.

Remediation Steps

1. Update CWP: The only definitive solution is to update CWP to version 0.9.8.1205 or later. CWP typically has an auto-update feature, but administrators should manually verify that the update has been applied. This is a direct application of D3-SU: Software Update.
2. Restrict Access: If immediate patching is not possible, restrict access to the CWP admin portal (typically on port 2031) to only trusted IP addresses via firewall rules. This significantly reduces the attack surface.
3. Post-Update Hardening: After updating, review all user accounts on the CWP instance and remove any that are unnecessary. Enforce strong, unique passwords for all remaining accounts.