PT-2025-22355 · Aapanel · Aapanel

Published 2025-05-21 · Updated 2025-12-27 · CVE-2024-42922

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions AAPanel version 7.0.7

Description The issue is related to an OS command injection, which can lead to remote command execution (RCE). It is estimated that more than 3.6 million servers globally are potentially affected.

Recommendations For AAPanel version 7.0.7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2024-42922

Affected Products

Aapanel

References · 8

• 🔥 https://gist.github.com/mstfsec/c4c05ddfb1cf8779422ff780587723c8 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-42922 · Security Note
• https://osv.dev/vulnerability/CVE-2024-42922 · Vendor Advisory
• https://twitter.com/CVEnew/status/2005031808522506736 · Twitter Post
• https://twitter.com/mstfshx/status/1925234554144526365 · Twitter Post
• https://t.me/cvetracker/24373 · Telegram Post
• https://t.me/cvenotify/126629 · Telegram Post
• https://twitter.com/Hossted_OSS/status/1944673058457059600 · Twitter Post