Critical Control Web Panel vulnerability is actively exploited (CVE-2025-48703)
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-11371 | Unauthenticated Local File Inclusion in Gladinet CentreStack and Triofox Gladinet CentreStack and Triofox, in their default installation and configuration, contain an unauthenticated local file inclusion flaw (CWE-552) that allows unintended disclosure of system files to remote attackers. The flaw requires no privileges or user interaction (CVSS 3.1: AV:N/PR:N/UI:N, 7.5 High), so any internet-facing deployment is directly reachable over the network. An attacker gains access to system files that should not be externally readable, and related reporting indicates active attacks have chained the flaw — including with Gladinet's hardcoded keys — toward unauthorized access, code execution, and deployment of remote access tools. All versions prior to and including 16.7.10368.56560 of both products are affected. Exploitation has been observed in the wild: the vulnerability was added to CISA's KEV on 2025-11-04 and carries a 92.1% EPSS probability of exploitation within 30 days. Do: Upgrade CentreStack and Triofox to a release newer than 16.7.10368.56560, and apply vendor mitigations per CISA BOD 22-01 requirements (federal agencies must mitigate or discontinue use of affected versions). Until patched, restrict internet exposure of the service and review logs for suspicious unauthenticated requests, unexpected file reads, new accounts, or signs of follow-on compromise such as remote-access tool installation. The Huntress write-up referenced in this record provides exploitation context for detection guidance; no exploit code is required to confirm patch status. | 7.5 | 92% | KEV PoC |
| moderate≈ thousands (10^3–10^4) of internet-facing CentreStack/Triofox server deployments; exact counts unknown | |
| CVE-2025-48703 | Unauthenticated OS Command Injection RCE in CWP Control Web Panel CWP (Control Web Panel, also known as CentOS Web Panel) versions before 0.9.8.1205 contain an unauthenticated OS command injection flaw (CWE-78): shell metacharacters supplied in the t_total parameter of a filemanager changePerm request are passed to a shell and executed by the server. The only precondition is knowing a valid non-root username on the target, which raises attack complexity but can be trivially met through exposed or common account names. Successful exploitation yields remote code execution on the hosting server, and the scope-changed CVSS metric (S:C with C:H/I:H/A:H) indicates impact beyond the vulnerable component. Any CWP installation running a version earlier than 0.9.8.1205 is affected — typically internet-facing CentOS/RHEL/AlmaLinux servers run by small hosting providers, resellers, and administrators. The flaw is being actively exploited: CISA added it to the Known Exploited Vulnerabilities catalog on 2025-11-04, a public proof of concept is available, and EPSS assigns a 99.7% probability of exploitation within 30 days. Do: Upgrade to CWP 0.9.8.1205 or later using the panel's built-in update process, as required by CISA's KEV/BOD 22-01 guidance; until patched, restrict access to the CWP admin ports (2030/2031) to trusted IPs or a VPN and limit exposed usernames, since the attacker must know a valid non-root user. Review logs for filemanager changePerm requests containing metacharacters in the t_total parameter to detect exploitation attempts, and check for signs of post-exploitation such as unexpected processes, cron entries, or web shells. | 9.0 | 100% | KEV PoC |
| large≈ tens of thousands of internet-exposed CWP servers |
Full article503 words · extracted from helpnetsecurity.com · click to collapse
On Tuesday, CISA added two vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2025-11371, which affects Gladinet’s CentreStack and Triofox file-sharing and remote access platforms, and CVE-2025-48703, a vulnerability in Control Web Panel (CWP), a web hosting control panel designed for managing servers running CentOS or CentOS-based distributions.
While active exploitation of CVE-2025-11371 has been reported on since early October 2025, exploitation attempts involving CVE-2025-48703, though detected by cybersecurity professionals, have so far been less widespread (or observed).
What is Control Web Panel (CWP)?
CWP is server management software that runs on CentOS (whos development was discontinued in late 2020) and its community-driven successors, Rocky Linux and AlmaLinux.
CWP users can opt for the free version what offers core features for single-server management, and a (paid) Pro version with better security, automatic updates, and improved support.
The software is popular with virtual private server (VPS) and dedicated server operators and is used to manage services like web servers, databases, email servers, DNS, as well as security features.
About CVE-2025-48703
CVE-2025-48703 is a critical OS Command Injection flaw that “allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request.”
The vulnerability’s current CVSS string indicates that it’s exploitable remotely over a network, without prior authentication or user interaction, but also that it’s not trivially exploitable.
Maxime Rinaudo, co-founder of penetration testing firm Fenrisk, explained that attackers must know or guess a valid non-root username to bypass authentication requirements before exploiting CVE-2025-48703. The bad news is that such usernames are often predictable.
CVE-2025-48703 is triggered by sending a HTTPS request with a specially crafted t_total value to the user file manager endpoint (filemanager&acc=changePerm), and allows attackers to run commands as that local user. Thus, an attacker can drop web shells, create persistence, pivot, or escalate further depending on local misconfigurations.
What to do?
With Rinaudo’s technical write-up and PoC published in late June 2025 and other PoC exploits appearing on GitHub since, it was only a matter of time until attackers began attempting to exploit the flaw.
In July 2025, FindSec researchers noted that “exploits are being actively developed and shared in hacking forums,” and advised organization runing CWP to manage Linux-based web hosting environments to patch quickly.
According to Shodan, there are currently over 220,000 internet-facing CWP instances, though it remains unclear how many are still running a vulnerable version.
CVE-2025-48703 affects CWP versions before 0.9.8.1205, released in June 2025.
Users should:
- Upgrade to version 0.9.8.1205 or later.
- Restrict access to port 2083 (the user interface) to trusted IPs.
- Look for signs of compromise, e.g., unexpected reverse shell connections, suspicious chmod executions in logs, new or modified .bashrc, .ssh, or cron entries, connections to unfamiliar IP addresses, and unknown user accounts. If found, the host should be isolated, logs preserved, and a forensic investigation mounted.
- Use intrusion detection systems to detect/block exploitation attempts.
Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.helpnetsecurity.com/2025/11/05/control-web-panel-cve-2025-48703-exploited/