CVE Watch—

CVE-2025-48703

CWP Control Web Panel OS Command Injection Vulnerability

CVSS

—

Sem CVSS

EPSS

99.7%

p100

KEV

SIM

4 de nov. de 2025

Exploit Today

0-100

Publicado: — · Última mod.: —

EPSS · 30d

99.7%EPSS · 30 dias99.7%

2026-10-082026-11-05

Ficha do catálogo KEV

Produto

CWP / Control Web Panel

Vulnerabilidade

CWP Control Web Panel OS Command Injection Vulnerability

Adicionado ao KEV

4 de nov. de 2025

Corrigir até

25 de nov. de 2025

Uso conhecido em ransomware

Não

Descrição resumida

CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Ação necessária

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notas

https://control-webpanel.com/changelog ; https://nvd.nist.gov/vuln/detail/CVE-2025-48703

CVEs relacionados

CVECVSSEPSSKEVRExploitTítuloMod.

CVE-2022-44877—

100.0%

KEV—80CWP Control Web Panel OS Command Injection Vulnerability—