Security tracker
CVE-2025-48703: CWP Control Web Panel OS Command Injection Vulnerability
In short
CWP Control Web Panel has a weakness classified as OS command injection (CWE-78). CISA added it to its Known Exploited Vulnerabilities catalog on 2025-11-04. NVD lists CVSS 3.1 at 9 CRITICAL.
What it is
“CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.” — CISA KEV, retrieved 2026-11-01
“CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.” — NVD, retrieved 2026-11-01
Who is affected
CWP Control Web Panel. NVD lists the following versions as affected:
- Versions before 0.9.8.1205
Exploitation status
CISA KEV added: 2025-11-04. Known ransomware campaign use: Not reported by CISA. Due date CISA set for US federal civilian agencies: 2025-11-25.
Scores
NVD CVSS 3.1: 9 CRITICAL; vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H; source [email protected].
EPSS by FIRST: 99.66%; percentile 99.95; score date 2026-10-31. EPSS estimates the probability of exploitation in the next 30 days.
CWE: CWE-78.
Timeline
| Date | Event |
|---|---|
| 2025-09-19T18:15:36.620 | NVD published |
| 2025-11-04 | CISA KEV added |
| 2025-11-25 | CISA KEV due |
| 2026-06-17T09:30:12.133 | NVD last modified |
| 2026-10-31 | FIRST EPSS score |
CISA required action
“Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.” — CISA KEV
What to do
- Confirm whether you run CWP Control Web Panel and which version.
- Apply the vendor update or mitigation in the vendor advisory.
- Follow CISA’s required action.
- Review the vendor guidance on signs of compromise.
- Track the fix through completion.
Sources and dates
CISA Known Exploited Vulnerabilities Catalog, version 2026.10.30; retrieved 2026-11-01. CISA KEV data: CC0 1.0. No endorsement by CISA.
NVD retrieved: 2026-11-01. This product uses the NVD API but is not endorsed or certified by the NVD.
EPSS scores by FIRST; score date 2026-10-31.
Check your own domain's public security settings
The snapshot checks a domain you own or are authorized to check for DNS, HTTPS/TLS and web-header hygiene. It does not test for this CVE.