CISA reports active exploitation of critical vulnerability in CentOS Web Panel

CISA is warning of active exploitation of a critical remote command execution vulnerability in Control Web Panel (CWP), formerly known as CentOS Web Panel.

Control Web Panel is an open-source web hosting control panel designed to simplify Linux server management for system administrators and hosting providers. Originally developed as CentOS Web Panel, the software provides server administration capabilities for managing web servers running CentOS, Rocky Linux, and AlmaLinux distributions. 

The flaw is tracked as CVE-2025-48703 (CVSS score: 9.0). It allows unauthenticated remote attackers with knowledge of a valid non-root username to execute arbitrary shell commands on vulnerable systems, potentially leading to complete server compromise. 

The vulnerability is caysed by the changePerm endpoint in the in CWP's file manager module responsible for handling file permission changes. Security researcher Maxime Rinaudo discovered that the endpoint processes requests even when the per-user identifier parameter is omitted, allowing unauthenticated requests to reach code that expects an authenticated, logged-in user context. The t_total parameter—which functions as a file permission mode value in the chmod system command—is passed directly into a shell command without adequate sanitization or input validation. This creates an OS command injection vulnerability where attackers can inject shell metacharacters and arbitrary commands that the server will execute with the privileges of the targeted user account.

Attackers need to know or guess a valid non-root username on the target CWP installation. Security researchers note that usernames are often predictable, following common patterns like admin, user, webmaster, or company-specific naming conventions. Once an attacker identifies a valid username, they can craft a malicious HTTPS POST request to the file manager changePerm endpoint (filemanager&acc=changePerm) with a crafted t_total parameter value containing shell metacharacters and command injection payloads. 

In proof-of-concept demonstrations, researchers successfully spawned reverse shells, dropped web shells for persistent access, created new backdoor accounts, modified system configurations, exfiltrated sensitive data, and pivoted to other systems within the network infrastructure.

All versions prior to 0.9.8.1205 are vulnerable to this critical command injection flaw. According to Shodan, over 220,000 CWP instances are currently internet-facing, though the exact number still running vulnerable versions remains unclear.

Control Web Panel version 0.9.8.1205, released on June 18, 2025, contains the security fix for this vulnerability.

Organizations running Control Web Panel should patch their systems ASAP. 

Organizations that can't immediately patch their should restrict network access to CWP's management interface (typically port 2083 for user panel and port 2087 for admin panel) only from trusted IP addresses or VPN networks.

Security teams should conduct compromise assessments on all CWP installations to identify potential exploitation. 

Indicators of compromise include: 

• unexpected network connections to external IP addresses,
• suspicious chmod command executions in application or system logs that include shell metacharacters or unusual file permission patterns,
• new or modified shell configuration files such as .bashrc, .bash_profile, or .profile,
• unauthorized additions to SSH authorized_keys files,
• suspicious cron jobs or scheduled tasks, n
• ew user accounts that were not created through normal administrative processes,
• connections to unfamiliar or suspicious external IP addresses,
• unusual processes running with web server or application user privileges, 
• eb shell files or backdoor scripts in web-accessible directories.