CVE-2025-48703:
CWP (Control Web Panel) vulnerability allows unauthenticated remote code execution via shell metacharacters in filemanager changePerm requests.
Score
A numerical rating that indicates how dangerous this vulnerability is.
9.0Critical- Published Date:Sep 19, 2025
- CISA KEV Date:Nov 4, 2025
- Industries Affected:20
46 DaysThreat Predictions
- EPSS Score:46.4
- EPSS Percentile:98%
Exploitability
- Score:2.2
- Attack Vector:NETWORK
- Attack Complexity:HIGH
- Privileges Required:NONE
- User Interaction:NONE
- Scope:CHANGED
Impact
- Score:6.0
- Confidentiality Impact:HIGH
- Integrity Impact:HIGH
- Availability Impact:HIGH
Description Preview
CWP (Control Web Panel) vulnerability allows unauthenticated remote code execution via shell metacharacters in filemanager changePerm requests.
Overview
CVE-2025-48703 is a critical vulnerability in CWP affecting versions before 0.9.8.1205. It enables unauthenticated remote code execution, potentially granting attackers full control over the affected system. The vulnerability stems from improper input sanitization in the filemanager's changePerm functionality. Exploiting this flaw requires knowledge of a valid non-root username, slightly increasing the attack complexity. The CVSS v3.1 base score is 9.0, indicating a critical severity level. The attack vector is network-based, requires no user interaction, and can result in a changed scope with high impacts on confidentiality, integrity, and availability.
Remediation
- To mitigate this vulnerability, system administrators should immediately upgrade CWP to version 0.9.8.1205 or later. If immediate upgrading is not possible, consider implementing additional security measures such as:
- 1. Restricting access to the CWP interface through firewall rules or VPN.
- 2. Implementing strong authentication mechanisms.
- 3. Regularly monitoring system logs for suspicious activities.
- 4. Applying the principle of least privilege to user accounts.
- 5. Conducting regular security audits and penetration testing.
- Additionally, it's crucial to keep all software components up-to-date and follow security best practices to minimize the risk of exploitation.
References
- [1] Fenrisk. (n.d.). RCE CentOS WebPanel. Retrieved from https://fenrisk.com/rce-centos-webpanel
- [2] MITRE. (2025). CVE-2025-48703. Retrieved from https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-48703
- [3] NIST. (2025). National Vulnerability Database - CVE-2025-48703. Retrieved from https://nvd.nist.gov/vuln/detail/CVE-2025-48703
Armis Early Warning
Armis Early Warning provides proactive threat intelligence and early detection capabilities.Click here to learn more.
- Armis Alert Date:*No Data*
- CISA KEV Date:Nov 4, 2025
- Days Early:46 Days
Industries Affected
Below is a list of industries most commonly impacted or potentially at risk based on intelligence.
