Vulnerability intelligence

CVE-2025-48703

CWP Control Web Panel OS Command Injection Vulnerability

CWP Control Web Panel CWE-78

CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

CVSS Score

Critical

EPSS — Exploit Probability

70%

Riskier than 99% of all CVEs

Exploitation

Confirmed in the wild

Used in ransomware campaigns

Remediation

Patch available

Federal deadline 2025-11-25

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. Deadline for federal agencies: 2025-11-25.

NVD entry Vendor patch PoC / advisory CISA KEV

1 article across 1 outlet · first covered May 7, 2026 · latest May 7, 2026

Coverage timeline

PCPJack worm spreads across cloud, stealing credentials via CVEs
thehackernews.com · May 7, 2026