CIS flags CVE-2025-48703 pre-auth RCE in CWP
A free hosting control panel becomes a server takeover path when the admin surface stays internet-facing and unpatched.
TL;DR
CIS MS-ISAC advisory 2025-100 warns that CWP, also known as Control Web Panel or CentOS Web Panel, before 0.9.8.1205 allows unauthenticated remote code execution through shell metacharacters in filemanager changePerm requests. Primes, subs and municipal IT shops running CWP should patch after testing. Public proof-of-concept code means the safe assumption is scanning, not theory.
CIS MS-ISAC’s advisory is the kind of vulnerability item that does change Monday for the small teams that still have CWP managing web hosting, DNS, email and firewall configuration. CVE-2025-48703 affects CWP before 0.9.8.1205 and can let an unauthenticated attacker trigger command injection through the t_total parameter in a filemanager changePerm request, although the advisory says a valid non-root username must be known. That is not much comfort on a Linux server administration panel exposed on the public internet.
The practical work is narrow: identify CWP instances, confirm version 0.9.8.1205 or later, and apply updates from CentOS or other vendors after appropriate testing. For municipal IT and smaller contractor environments, the harder part is usually inventory, not the patch button. CIS also says proof-of-concept code is already public, which turns this from a scheduled vulnerability-management item into an exposure question: if the panel is reachable, assume someone else is checking it too.
Published ·Deep Fathom