In CISA KEV9.0 CriticalCWE-78
CVE-2025-48703
CWP Control Web Panel OS Command Injection Vulnerability
CWPControl Web Panel
Status
- Exploited in the wild
- In CISA KEV since 4 Nov 2025
- Fixed in version 0.9.8.1205
Federal deadlineTue 25 Nov 2025, 23:59 UTC
Passed 333 days ago
CISA KEV · added 4 Nov 2025
Exploit probabilityEPSSchecked 23 Oct
99.6%probability of exploitation in the next 30 days
Higher than 100% of scored CVEs
SeverityCVSS
9.0Critical
Description NVD
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Coverage No articles yet
No CyberSIXT article names CVE-2025-48703 yet. New articles appear here and in the RSS feed.