Is CVE-2025-48703 (CWP Control Web Panel OS Command Injection) being exploited in the wild?

By NHI Mgmt Group Editorial Team Updated October 19, 2026 Domain: Threats, Abuse & Incident Response

Yes. CISA added CVE-2025-48703 to its Known Exploited Vulnerabilities catalogue on 4 November 2025, which it does only when there is reliable evidence of active exploitation. CISA has not linked it to known ransomware campaigns. CWP Control Web Panel (formerly CentOS Web Panel) contains an OS command Injection vulnerability that allows unauthenticated remote code execution via shell metacharacters in the t_total parameter in a filemanager changePerm request.

How CISA’s KEV Listing Changes the Meaning of “Exploited in the Wild”

CISA’s addition of CVE-2025-48703 to the Known Exploited Vulnerabilities catalogue is the key operational signal here. For a practitioner, that means the issue is not just theoretically dangerous, it has crossed into confirmed active exploitation, so exposure should be treated as an incident-priority vulnerability rather than a routine patch item.

That matters because KEV status changes triage. A web panel flaw that enables unauthenticated remote code execution can be used immediately after discovery, so the first question is whether the vulnerable panel is internet-facing, reachable by trusted internal users, or hidden behind compensating controls that actually limit exploitation.

When a vulnerability is already in KEV, the practical decision is not whether it is worth tracking, but whether it is still present anywhere in the environment and whether attackers may already have used it to gain command execution on the host.

What the CWP Control Web Panel Flaw Lets an Attacker Do

The direct answer identifies the vulnerability as an OS command injection in CWP Control Web Panel, triggered through shell metacharacters in the t_total parameter of a filemanager changePerm request. That is a dangerous class of flaw because it can convert a normal web request into operating system command execution without valid authentication.

In practice, this kind of weakness can collapse the boundary between the web application and the underlying server. Once remote command execution is possible, the attacker may be able to read files, alter permissions, create or modify web content, install a web shell, or stage additional tooling for persistence and lateral movement.

For defenders, the important point is that the vulnerability is not merely about the panel interface. It is about whether the panel can be trusted to safely process user-supplied parameters that reach a shell context.

What to Check First on an Exposed CWP Installation

Start by confirming whether any instance of CWP Control Web Panel is deployed, reachable, and still in service. Then check whether the filemanager changePerm workflow is enabled or exposed in a way that could be abused remotely, especially on servers that are also externally accessible.

If the panel is present, assume an attacker may have tested it already. Review web access logs, authentication logs, process creation events, shell history where available, scheduled tasks, unexpected configuration changes, new local users, and unfamiliar outbound connections from the server.

Because the flaw permits command execution, post-exploitation activity may not look like a classic web-only incident. You may see a burst of normal-looking HTTP requests followed by system-level actions such as downloaded scripts, new cron entries, modified permissions, or binary execution from unusual paths.

Risk and Threat Considerations

Once a vulnerability is confirmed in KEV, the main risk is not just exposure, but unattended compromise. Unauthenticated command injection can give an external attacker immediate code execution on a management surface that often sits close to sensitive hosting, credentials, and server administration workflows.

Failure mechanism: The application passes attacker-controlled input into a shell context, shell metacharacters break out of the intended command structure, and the remote request becomes arbitrary OS command execution.

Impact: An attacker can potentially take control of the host, plant persistence, modify web assets, steal data, or use the server as a launch point for further intrusion.

Framework Alignment

CISA Known Exploited Vulnerabilities Catalog is directly relevant because the question is specifically about confirmed in-the-wild exploitation and operational prioritisation.

NIST National Vulnerability Database supports vulnerability record lookups and technical context for the CVE and affected-product review process.

FIRST EPSS is useful for prioritising exposure when exploit likelihood and remediation urgency need to be weighed alongside KEV status.

Zero-Day and Exploited Vulnerabilities Guide helps with KEV triage, emergency mitigation, and post-patch hunting when active exploitation is already established.

Web Application Attacks Guide is relevant because OS command injection is a web application attack pattern that can translate directly into host compromise.

Vulnerability Management Guide is useful for triage, remediation workflow, verification, and tracking remediation outcomes after an exploited vulnerability is identified.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

CIS Controls v8, NIST CSF 2.0 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.

Framework	Control / Reference	Relevance
CIS Controls v8	CIS-7 — Continuous Vulnerability Management	This is an actively exploited vulnerability that requires rapid identification and remediation.
Recommendation — Prioritise and remediate KEV-listed exposures immediately.
NIST CSF 2.0	DE.CM-01 — Networks and systems are monitored to detect potential cybersecurity events	The answer depends on confirming exposure and hunting for signs of exploitation.
	RS.MA-01 — Incident management is performed to contain incidents	Active exploitation turns remediation into containment and response work.
Recommendation — Monitor exposed hosts for exploitation indicators and unusual execution activity. Contain affected servers before and during remediation when compromise is suspected.
NIST SP 800-53 Rev 5	SI-2 — Flaw Remediation	The issue requires urgent patching or mitigation after KEV confirmation.
	AU-6 — Audit Record Review, Analysis, and Reporting	Compromise assessment requires review of logs and system activity.
Recommendation — Apply the vendor fix or mitigation as soon as possible. Review logs for command execution and post-exploitation behaviour.

Practitioner Guidance

What to prioritise: Treat every exposed CWP instance as high priority until you have confirmed it is patched, isolated, or removed from service. If patching cannot happen immediately, reduce exposure by removing public reachability and limiting administrative access to trusted management networks only.

What to verify: Verify whether the host shows evidence of command execution after the KEV date, not just whether the panel is vulnerable. A clean patch does not prove the machine was never used as a foothold, so review logs and system artefacts before declaring the host safe.

Decision rule: If the instance was internet-facing or the panel handled privileged administration, assume the blast radius is larger than the panel itself and escalate for compromise assessment, credential review, and integrity checks on the server and adjacent management accounts.

Practitioner takeaway: KEV listing means the burden shifts from proving exploitability to proving the host was not already abused, so response should combine urgent remediation with compromise hunting.

Deepen Your Knowledge

Free weekly newsletter

Subscribe to the NHI & AI Identity Journal

The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.

Bonus 33% off our NHI Course when you subscribe.

NHIMG Editorial Note
Reviewed and updated by the NHIMG editorial team on October 19, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org