CISA Warns of CWP Vulnerability Exploited in the Wild

CISA warned that a critical vulnerability in Control Web Panel (CWP), tracked as CVE-2025-48703, has been exploited in the wild. According to SecurityWeek, the flaw allows remote, unauthenticated attackers to execute arbitrary commands on vulnerable systems, with an attacker who has a valid non-root username able to bypass authentication and run commands via specially crafted requests. The vulnerability was reported to CWP developers in mid-May and patched roughly one month later with version 0.9.8.1205.

Netlas[.]io indicates there are roughly 150,000 internet-exposed CWP instances potentially affected, while Shodan shows more than 220,000. Given this widespread exposure, it’s highly likely that exploitation in opportunistic attacks has occurred. CISA added CVE-2025-48703 to its Known Exploited Vulnerabilities (KEV) catalog and instructed federal agencies to address it by 25 November.