Vulnerabilities CVE-2025-48703

CVE-2025-48703

Medium

Open

KEV

TLP:CLEAR

CWP Control Web Panel OS Command Injection Vulnerability

NVD CVE.org

Critical Infrastructure

AI Analysis

No AI analysis yet.

Description

CWP — Control Web Panel — CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.

Details

EPSS Score ⓘ: 99.62%

99.9th percentile
Confidence: 100%
CISA KEV
Date Added: Nov 4, 2025
Patch Due: Nov 25, 2025
Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

No notes yet. Click "Add Note" to create the first analysis note.

Opinions

No opinions yet. Be the first to assess this intelligence.