CVE-2018-25117VestaCP Debian Installer Malicious Backdoor Supply Chain Compromise
Updated under an hour ago ()
Does this affect you?
It affects Vesta Control Panel (CP). Add what you run to find out whether that includes you.
No exploitation reported and no EPSS estimate yet.
Do this next
Free account, 1 product
VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS bot that uses Lua for second- and third-stage components. The compromise leaked administrative credentials (base64-encoded admin password and server domain) to an external URL during installation and/or resulted in the installer dropping and executing a DDoS malware payload under local system privileges. Compromised servers were subsequently observed participating in large-scale DDoS activity. Vesta acknowledged exploitation in the wild in October 2018.
- CVSS
- 9.3 CRITICAL (v4.0, CNA)CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N
- Weakness (CWE)
- CWE-506
- Known exploited
- Not in CISA's KEV catalog
- EPSS (exploitation in the next 30 days)
- Not loaded for this CVE
- Assigned by
- VulnCheck
- NVD analysis
- Deferred
- Record last updated
- Jun 23, 2026
- First seen by InfoSec Signals
- Oct 9, 2026
Affected products
Vesta Control Panel (CP) vesta:control_panel_cp (from the name) | from a3f0fa1501d424477786e3e7150bb05c0b99518f before ee03eff016e03cb76fac7ae3a0f9d1ef0f8ee35b | CNA record |
References
- https://www.welivesecurity.com/2018/10/18/new-linux-chachaddos-malware-distributed-servers-vestacp-installed/technical-description
- https://github.com/outroll/vesta/commit/ee03eff016e03cb76fac7ae3a0f9d1ef0f8ee35b#diff-df8da0c91e9086454c60cd468849630dL1270patch
- https://github.com/outroll/vesta/commit/a3f0fa1501d424477786e3e7150bb05c0b99518f#diff-df8da0c91e9086454c60cd468849630dR1256patch
- https://forum.vestacp.com/viewtopic.php?f=10&t=17641&p=73282issue-tracking
- https://forum.vestacp.com/viewtopic.php?f=10&t=17641&start=180#p73907vendor-advisory, patch
- https://vestacp.com/product
- https://github.com/outroll/vestaproduct
- https://www.vulncheck.com/advisories/vestacp-debian-installer-malicious-backdoor-supply-chain-compromisethird-party-advisory
The CVE record on cve.org NVD's entry
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.