CVE-2025-48703Patch(control-webpanel / webpanel)

⚠️ **Vulnerability Alert:** CentOS Web Panel (CWP) Remote Code Execution (RCE) - CVE-2025-48703 🆔 **CVE-2025-48703** | 📊 CVSS: 9.0 (CRITICAL 🔴) | 📈 EPSS: 98.336% 🛠️ **Exploit Maturity:** Proof-of-Concept 📂 **Affected Versions:** < 0.9.8.1205 🔧 **Fixed Versions:** 0.9.8.1205 🫨 **Attack Vectors:** - Network (remote, unauthenticated) - Command injection via 't_total' parameter in filemanager changePerm request - Requires knowledge of a valid non-root username - High attack complexity (AV:N/AC:H) 📝 **Summary:** Unauthenticated attackers can achieve remote code execution in CWP via the t_total parameter, allowing hijack of non-root accounts and potential full server compromise. Public PoC increases the risk of active exploitation — patch immediately. 📈 **Impact Scope:** Unauthenticated RCE enabling hijack of non-root accounts, lateral movement, persistence, and potential full server compromise on affected CWP hosts. Public PoC increases exploitation risk. 🛡️ **Recommended Actions:** - Apply vendor update to 0.9.8.1205 or later immediately - Restrict network access to CWP interfaces and implement firewall/ACLs 🪢 **Related Resources:** - https://control-webpanel.com/changelog - https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-48703 🏷 **Tags:** #Cybersecurity #CWP #RCE

"PCP replaced" - the metric tracked by PCPJack's C2. PCPJack is a Linux credential-stealing worm disclosed May 7, 2026 by SentinelLabs. It exploits five CVEs to spread: - CVE-2025-29927 (Next.js middleware auth bypass) - CVE-2025-55182 "React2Shell" (Next.js Server Actions deserialization) - CVE-2026-1357 (WPVivid Backup unauth file upload) - CVE-2025-9501 (W3 Total Cache PHP injection via cached mfunc) - CVE-2025-48703 (CentOS Web Panel Filemanager shell injection) http://bootstrap.sh kills competing TeamPCP processes before installing itself, then drops six Python scripts handling orchestration, credential parsing, lateral movement, encryption, cloud-IP refresh, and port scanning. Lateral movement targets SSH, Kubernetes, Docker, Redis, RayML, MongoDB. Persistence via systemd, cron, Redis rewrites, and privileged containers. Targets pulled from Common Crawl parquet files. http://check.sh probes IMDS endpoints and Kubernetes service accounts. Credentials harvested cover Anthropic, OpenAI, HashiCorp Vault, 1Password, Slack, SSH keys, and WordPress configs. Exfil uses X25519 ECDH + ChaCha20-Poly1305, 2800-byte chunks, to Telegram. SentinelLabs links it to a likely former TeamPCP affiliate from tooling overlap. No cryptomining, unlike TeamPCP - the C2 explicitly tracks "PCP replaced" successes. A worm built to evict its predecessor and harvest the cloud underneath.