CVE-2025-48703
CRITICAL KEV NUCLEICWP <0.9.8.1205 - RCE
Title source: llmDescription
CWP (aka Control Web Panel or CentOS Web Panel) before 0.9.8.1205 allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request. A valid non-root username must be known.
Exploits (5)
Nuclei Templates (1)
CWP (Control Web Panel) < 0.9.8.1205 - Remote Code Execution
CRITICALby theamanrawat
Shodan:
Server: cwpsrv
Scores
CVSS v3
9.0
EPSS
0.6202
EPSS Percentile
98.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H
Details
CISA KEV
2025-11-04
VulnCheck KEV
2025-08-15
ENISA EUVD
EUVD-2025-30324
CWE
CWE-78
Status
published
Products (1)
control-webpanel/webpanel
< 0.9.8.1205
Published
Sep 19, 2025
KEV Added
Nov 04, 2025
Tracked Since
Feb 18, 2026