Risk Letters

Exploited vulnerability

CVE-2025-48703

TLP:CLEAR

CWP Control Web Panel OS Command Injection Vulnerability

CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Facts

  • Vendor: CWP
  • Product: Control Web Panel
  • CVSS: 9
  • EPSS (probability of exploitation within 30 days): 99.7 %
  • On CISA's Known Exploited Vulnerabilities list since: 4 November 2025
  • First known exploitation: 4 November 2025
  • CISA's deadline for US federal agencies: 25 November 2025
  • Weakness: CWE-78
  • First seen by Risk Letters: 4 November 2025

Members see which Nordic sectors the flaw hits, and what to do about it.

Get the full brief

Data: NVD (public domain), CISA KEV, FIRST EPSS, MITRE ATT&CK, AlienVault OTX. NVD