PT-2025-31842 · Zpanel · Zpanel

Published 2025-08-04 · Updated 2025-08-04 · CVE-2013-10052

Positive Technologies (AI Summary)

CVSS v4.0

8.5

High

Base vector

AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions ZPanel (affected versions not specified)

Description ZPanel includes a helper binary named zsudo, designed for restricted privilege escalation for administrative tasks. If incorrectly configured in /etc/sudoers, zsudo can be invoked by low-privileged users to execute arbitrary commands as root. This allows local attackers with shell access to escalate privileges by writing a payload to a writable directory and executing it via zsudo. The issue is particularly impactful following web server compromise, where the attacker inherits access to zsudo.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

CVE-2013-10052

Affected Products

Zpanel

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2013-10052 · Security Note
• https://github.com/zpanel/zpanelx · Note
• https://vulncheck.com/advisories/zpanel-zsudo-local-priv-esc · Note
• https://t.me/CVEtracker/29107 · Telegram Post
• https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/local/zpanel_zsudo.rb · Note
• https://t.me/cveNotify/130818 · Telegram Post
• https://exploit-db.com/exploits/26451 · Note