CVE-2025-48703—CWP Control Web Panel OS Command Injection Vulnerability

漏洞名称

CWP Control Web Panel OS Command Injection Vulnerability

描述

CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

已知用于勒索软件活动吗？

勒索软件状态：

Unknown

采集行动

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

其他说明

• https://control-webpanel.com/changelog
• https://nvd.nist.gov/vuln/detail/CVE-2025-48703

相关新闻文章

• PCPJack Credential Stealer Exploits 5 CVEs to Spread Worm-Like Across Cloud SystemsMay 7, 2026
• New PCPJack worm steals credentials, cleans TeamPCP infectionsMay 7, 2026
• CISA warns of critical CentOS Web Panel bug exploited in attacksNovember 5, 2025
• Critical Control Web Panel vulnerability is actively exploited (CVE-2025-48703)November 5, 2025
• CISA Adds Gladinet and CWP Flaws to KEV Catalog Amid Active Exploitation EvidenceNovember 5, 2025

相关 CWE

• CWE-78