Control Web Panel EUVD-2025-209736

Remote unauthenticated exploitation against Control Web Panel installations that have either Softaculous auto-installer or SitePad website builder components installed and enabled. The vulnerable /admin/index.php API endpoint with 'api' parameter handling is only present or accessible when these optional extensions are active. Default CWP installations without Softaculous or SitePad are not vulnerable. No authentication, user interaction, or non-default configuration beyond the presence of these specific extensions is required. Attack succeeds against internet-exposed CWP admin panels (default ports 2030 HTTP, 2031 HTTPS) without IP whitelisting or additional access controls.

CVSS 7.3 (High) with vector AV:N/AC:L/PR:N/UI:N indicates remote unauthenticated exploitation with low complexity, but impact scores of L/L/L across confidentiality, integrity, and availability appear inconsistent with root command execution capability described in the CVE. The CVSS scoring likely underestimates real-world impact - root RCE typically warrants High impact ratings. EPSS 6.16% at 91st percentile indicates elevated exploitation probability relative to other CVEs, suggesting active reconnaissance or limited exploitation. Public exploit code exists (KIS-2025-09 advisory and FullDisclosure posting), dramatically lowering exploitation barrier. However, the requirement for Softaculous or SitePad installation significantly reduces the vulnerable population - not all CWP deployments include these optional components. SSVC factors: exploitation is Public (POC available), likely Automatable (simple GET request), Technical Impact is Total (root access), but Attack Surface is Partial (conditional on optional components). Priority depends on whether targeted environments use Softaculous/SitePad. No CISA KEV listing suggests exploitation remains targeted rather than widespread, but the 91st percentile EPSS score and public POC warrant urgent patching for affected installations.

An unauthenticated attacker identifies a CWP installation with Softaculous or SitePad enabled through reconnaissance of open ports (2030/2031) or HTTP headers. The attacker crafts a malicious GET request to /admin/index.php with 'api' parameter set and injects OS commands into the 'key' parameter using shell metacharacters (semicolons, pipes, backticks). The unsanitized input executes as root, allowing the attacker to create backdoor accounts, install cryptominers, exfiltrate hosting customer data, or pivot to other infrastructure. Public exploit code from Karma Insecurity (KIS-2025-09) provides ready-made payloads, enabling even low-skilled attackers to compromise vulnerable systems.