CVE-2025-48703

What it actually does

CWP (Control Web Panel/CentOS Web Panel) versions before 0.9.8.1205 contain an unauthenticated OS command injection flaw in the file manager permission-change workflow. The vulnerable request accepts a t_total parameter during a changePerm action and fails to safely neutralize shell metacharacters. If an attacker knows a valid non-root username on the server, they can inject shell syntax into that parameter and cause the panel host to execute attacker-controlled commands. Because CWP is a server administration panel, successful exploitation can lead to full compromise of hosted services, credential theft, persistence, lateral movement, and deployment of malware or tooling.

Why it matters to the business

This is a critical, internet-exploitable administrative-panel vulnerability with active exploitation reported in the wild, an EPSS score indicating very high likelihood of exploitation, and inclusion in CISA KEV with a remediation due date of 2025-11-25. Organizations running exposed CWP instances risk unauthorized server takeover, website defacement, theft of hosted data, email abuse, service disruption, malware installation, and use of the compromised host as infrastructure for further attacks. Even though a valid non-root username must be known, usernames are often guessable, leaked, exposed in hosted content, or discoverable through other services, so this requirement should not be treated as a meaningful barrier.

How an attack unfolds

An attacker first identifies an internet-facing CWP instance and determines or guesses a valid non-root username associated with the server. The attacker then sends a crafted unauthenticated filemanager changePerm request. Instead of providing only expected permission-related values, the attacker places shell metacharacters in the t_total parameter, such as command separators, pipes, command substitution, or encoded equivalents. The vulnerable CWP code passes this value into a shell context, causing the injected command to run on the server. Initial commands commonly verify execution with id, whoami, uname, or outbound callbacks, followed by retrieval of payloads using curl or wget, installation of web shells or backdoors, creation of cron/systemd persistence, credential harvesting from panel and hosted application configuration files, and further movement to hosted websites, mail services, databases, or adjacent systems. Threat intelligence indicates active exploitation activity; any exposed vulnerable instance should be treated as at high risk even if no ransomware association is currently listed in KEV.

How to fix it

Upgrade CWP to version 0.9.8.1205 or later immediately. If the service is internet-exposed, prioritize remediation ahead of routine patch cycles because exploitation is active in the wild and the vulnerability is in CISA KEV. If immediate upgrade is not possible, restrict access to the CWP administrative interface to trusted management IP addresses or VPN-only access, block unauthenticated access to filemanager/changePerm functionality at a reverse proxy or WAF where feasible, disable or remove exposed CWP services until patched, and monitor aggressively for exploitation attempts. Rotate credentials and secrets stored on or managed by the server if exploitation is suspected, including panel users, SSH keys, database credentials, mail credentials, application secrets, and API keys. After patching, review the server for persistence, unknown users, malicious cron jobs, unauthorized SSH keys, modified hosted web files, and suspicious processes.

How to confirm the fix worked

Confirm the installed CWP version is 0.9.8.1205 or later using the panel UI, package metadata, or CWP version files/commands supported by the installation. From an untrusted network path, verify that the CWP administrative interface is not publicly reachable unless intentionally exposed and protected by compensating controls. Review web access logs to confirm that unauthenticated filemanager changePerm requests are rejected after the upgrade. In an authorized test environment only, send a benign malformed t_total value containing shell metacharacters and verify that it is rejected, sanitized, or handled without command execution. Validate that WAF/reverse-proxy rules detect requests containing filemanager, changePerm, t_total, and encoded shell metacharacters. Finally, perform host-level checks for indicators of prior compromise, because patching stops new exploitation but does not remove malware or persistence created before remediation.

Typical attack path

1. Scan the internet for exposed CWP/Control Web Panel services.
2. Fingerprint the target to determine whether it is running a version before 0.9.8.1205.
3. Identify, enumerate, guess, or reuse a valid non-root username on the server.
4. Send an unauthenticated filemanager changePerm request containing shell metacharacters in the t_total parameter.
5. Execute a simple validation command such as id, whoami, uname, or an outbound curl/wget callback.
6. Download and execute a second-stage payload, web shell, reverse shell, bot, or credential-harvesting script.
7. Establish persistence through cron jobs, systemd units, SSH keys, modified web content, or new local users.
8. Harvest credentials and configuration secrets from hosted websites, databases, mail services, and CWP-related files.
9. Use the compromised server for data theft, service disruption, malware hosting, spam, proxying, or lateral movement.

How to detect it

Look for evidence in CWP logs, web server access/error logs, reverse proxy logs, WAF alerts, authentication logs, auditd/EDR process telemetry, shell history, cron directories, systemd unit directories, and file-integrity monitoring. The most important request pattern is an unauthenticated filemanager changePerm action with a t_total parameter containing shell metacharacters such as semicolon, pipe, ampersand, backticks, $(), newline characters, or URL-encoded equivalents. Correlate suspicious requests with child processes spawned by the CWP/web server process, especially /bin/sh, /bin/bash, curl, wget, python, perl, nc, ncat, socat, chmod, chattr, base64, or openssl. Review outbound network connections immediately after suspicious requests, particularly callbacks to unfamiliar IPs or downloads into /tmp, /var/tmp, /dev/shm, web roots, or user home directories. Hunt for persistence artifacts such as new cron jobs, systemd services, rc.local modifications, unauthorized SSH keys, new local users, modified sudoers files, web shells, packed binaries, miners, and unusual long-running processes. If threat intelligence feeds label activity related to this vulnerability or campaigns such as LANDFALL, pivot on the same request patterns, callback infrastructure, payload hashes, and post-exploitation commands rather than relying only on the campaign name.

• filemanager
• changePerm
• t_total=
• t_total=%3B
• t_total=;
• t_total=%7C
• t_total=|
• t_total=%26
• t_total=&
• t_total=%60
• t_total=`
• t_total=%24%28
• t_total=$(
• t_total=%0A
• changePerm*t_total
• /bin/sh -c
• /bin/bash -c
• curl http
• curl -fsSL
• wget http
• wget -O
• chmod +x /tmp
• chmod +x /var/tmp
• chmod +x /dev/shm
• /tmp/.
• /var/tmp/.
• /dev/shm/.
• nc -e
• ncat -e
• bash -i
• python -c
• perl -e
• crontab -l
• /etc/cron.d/
• /var/spool/cron/
• /etc/systemd/system/
• authorized_keys
• useradd
• adduser
• chattr +i

What your security team should do

• Patch all CWP installations to 0.9.8.1205 or later immediately, prioritizing internet-facing systems and aligning with the CISA KEV due date of 2025-11-25.
• Temporarily restrict CWP access to VPN or trusted administrative IP ranges until patching and compromise assessment are complete.
• Assume exposed vulnerable systems may have been targeted due to active in-the-wild exploitation and the very high EPSS likelihood; initiate threat hunting before closing the incident.
• Search historical web, proxy, WAF, and CWP logs for filemanager changePerm requests containing t_total and shell metacharacters or URL-encoded equivalents.
• Review Linux host telemetry for web-service-spawned shells, curl/wget downloads, reverse shells, suspicious cron entries, new users, new SSH authorized_keys entries, and unexpected systemd services.
• Rotate credentials and secrets on any server with evidence of exploitation, including CWP users, SSH keys, hosted application secrets, database passwords, and mail credentials.
• Add WAF or reverse-proxy detections for changePerm requests with suspicious t_total values, but do not rely on filtering as a substitute for upgrading.
• If compromise is confirmed, preserve logs and disk artifacts, isolate the host, rebuild from known-good media where practical, and restore hosted content from trusted backups.