CVE-2018-25117: Panel backdoored installer, not

CISO Take

This CVE describes a 2018 supply-chain compromise of the VestaCP Linux hosting control panel installer, which leaked admin credentials and dropped the Linux/ChachaDDoS DDoS bot on new installs between May and June 2018 — it has no genuine connection to AI/ML systems despite being tagged 'ml_ui' in this feed, likely because VestaCP's dashboard superficially resembles an ML control-panel UI. Blast radius here (488 downstream dependents, 42 other CVEs in the package) reflects VestaCP's general hosting-panel ecosystem, not any AI/ML deployment footprint. EPSS sits at 0.4% (top 68th percentile) and there is no public exploit, nuclei template, or CISA KEV listing, and CISA's own SSVC decision is the low-urgency 'ATTEND'. If your organization ever provisioned a server using the VestaCP installer between 2018-05-31 and 2018-06-13, treat it as compromised: rebuild from a clean, verified installer, rotate all admin credentials, and hunt for Lua-based ChachaDDoS artifacts and outbound DDoS traffic — but do not route this into AI/ML risk reporting or ATLAS mappings, as doing so would misrepresent your actual AI attack surface.

Sources: NVD EPSS CISA KEV OpenSSF

What is the risk?

Low relevance to AI/ML risk posture. The underlying issue (a backdoored open-source installer leading to credential theft and DDoS malware deployment) is a classic IT supply-chain compromise with real but dated impact (2018) on any general-purpose Linux server using the compromised VestaCP installer window. There is no public exploit or scanner template, no CISA KEV listing, and EPSS is negligible (0.4%), so opportunistic re-exploitation risk today is low — the residual risk is limited to legacy servers never rebuilt since 2018. From an AI/ML governance standpoint, this CVE should not be treated as evidence of AI-specific exposure; its presence in this feed under 'ml_ui' appears to be a categorization artifact rather than a genuine AI system finding.

How does the attack unfold?

Backdoored installer distribution

Attacker compromises the VestaCP installer source between commits a3f0fa1 and ee03eff, embedding credential-exfiltration and malware-drop logic.

Victim installation

A user provisions a new server using the compromised installer, unknowingly triggering the malicious code during setup.

Credential exfiltration

The installer base64-encodes the admin password and server domain and sends them to an external attacker-controlled URL.

DDoS botnet impact

The installer drops and executes the Linux/ChachaDDoS multi-stage bot with local system privileges, enrolling the server in large-scale DDoS activity.

Backdoored installer distribution

Attacker compromises the VestaCP installer source between commits a3f0fa1 and ee03eff, embedding credential-exfiltration and malware-drop logic.

Victim installation

A user provisions a new server using the compromised installer, unknowingly triggering the malicious code during setup.

Credential exfiltration

The installer base64-encodes the admin password and server domain and sends them to an external attacker-controlled URL.

DDoS botnet impact

The installer drops and executes the Linux/ChachaDDoS multi-stage bot with local system privileges, enrolling the server in large-scale DDoS activity.

What systems are affected?

Package	Ecosystem	Vulnerable Range	Patched
Panel	pip	—	No patch
5.7K OpenSSF 7.0 492 dependents Pushed 6d ago 63% patched ~16d to patch Full package profile →

Do you use Panel? You're affected.

How severe is it?

CVSS 3.1

N/A

EPSS

0.4%

chance of exploitation in 30 days

Higher than 34% of all CVEs

Source: EPSS v3 — FIRST.org

Exploitation Status

Exploit Available

Exploitation: MEDIUM

Sophistication

Moderate

Exploitation Confidence

medium

✓ VulnCheck KEV (exploitation reported — broader/earlier than CISA) — Sep 2018

○ CISA SSVC: Public PoC

Composite signal derived from CISA KEV, VulnCheck KEV, CISA SSVC, EPSS, Metasploit, Exploit-DB, trickest/cve, Nuclei templates, and inthewild.io exploitation reports.

What should I do?

1 step

Identify any servers provisioned with the VestaCP installer between 2018-05-31 and 2018-06-13; if found, treat them as compromised — do not attempt in-place remediation. Rebuild affected hosts from a verified, non-backdoored VestaCP release (post commit ee03eff) or migrate to an actively maintained control panel. Rotate all credentials (admin panel, database, SSH, DNS) that may have touched an affected host. Hunt for ChachaDDoS indicators: unexpected Lua interpreter processes, outbound connections to known C2 infrastructure referenced in the ESET/WeLiveSecurity writeup, and unusual outbound traffic volumes consistent with DDoS participation. This CVE does not require any AI/ML-specific controls, compliance mapping, or ATLAS-based detection engineering.

What does CISA's SSVC say?

Decision Attend

Exploitation poc

Automatable No

Technical Impact total

Source: CISA Vulnrichment (SSVC v2.0). Decision based on the CISA Coordinator decision tree.

How is it classified?

Supply Chain Code Execution DoS Framework

Which compliance frameworks are affected?

Compliance analysis pending. Sign in for full compliance mapping when available.

Frequently Asked Questions

What is CVE-2018-25117?

This CVE describes a 2018 supply-chain compromise of the VestaCP Linux hosting control panel installer, which leaked admin credentials and dropped the Linux/ChachaDDoS DDoS bot on new installs between May and June 2018 — it has no genuine connection to AI/ML systems despite being tagged 'ml_ui' in this feed, likely because VestaCP's dashboard superficially resembles an ML control-panel UI. Blast radius here (488 downstream dependents, 42 other CVEs in the package) reflects VestaCP's general hosting-panel ecosystem, not any AI/ML deployment footprint. EPSS sits at 0.4% (top 68th percentile) and there is no public exploit, nuclei template, or CISA KEV listing, and CISA's own SSVC decision is the low-urgency 'ATTEND'. If your organization ever provisioned a server using the VestaCP installer between 2018-05-31 and 2018-06-13, treat it as compromised: rebuild from a clean, verified installer, rotate all admin credentials, and hunt for Lua-based ChachaDDoS artifacts and outbound DDoS traffic — but do not route this into AI/ML risk reporting or ATLAS mappings, as doing so would misrepresent your actual AI attack surface.

Is CVE-2018-25117 actively exploited?

No confirmed active exploitation of CVE-2018-25117 has been reported, but organizations should still patch proactively.

How to fix CVE-2018-25117?

Identify any servers provisioned with the VestaCP installer between 2018-05-31 and 2018-06-13; if found, treat them as compromised — do not attempt in-place remediation. Rebuild affected hosts from a verified, non-backdoored VestaCP release (post commit ee03eff) or migrate to an actively maintained control panel. Rotate all credentials (admin panel, database, SSH, DNS) that may have touched an affected host. Hunt for ChachaDDoS indicators: unexpected Lua interpreter processes, outbound connections to known C2 infrastructure referenced in the ESET/WeLiveSecurity writeup, and unusual outbound traffic volumes consistent with DDoS participation. This CVE does not require any AI/ML-specific controls, compliance mapping, or ATLAS-based detection engineering.

What is the CVSS score for CVE-2018-25117?

No CVSS score has been assigned yet.

What are the technical details?

Original Advisory

VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS bot that uses Lua for second- and third-stage components. The compromise leaked administrative credentials (base64-encoded admin password and server domain) to an external URL during installation and/or resulted in the installer dropping and executing a DDoS malware payload under local system privileges. Compromised servers were subsequently observed participating in large-scale DDoS activity. Vesta acknowledged exploitation in the wild in October 2018.

Exploitation Scenario

An organization stands up a new Linux server and uses the (at-the-time trusted) VestaCP installer to configure hosting. Unknown to the admin, the installer script was backdoored between two specific commits, so during setup it silently base64-encodes and exfiltrates the admin password and server domain to an attacker-controlled URL, then drops and executes a multi-stage DDoS payload with local system privileges. The compromised server subsequently joins a botnet, generating outbound DDoS traffic and consuming its own resources without any legitimate application (AI/ML or otherwise) being involved.

Weaknesses (CWE)

CWE-506 Embedded Malicious Code

CWE-506 — Embedded Malicious Code: The product contains code that appears to be malicious in nature.

[Implementation, Operation] Remove the malicious code and start an effort to ensure that no more malicious code exists. This may require a detailed review of all code, as it is possible to hide a serious attack in only one or two lines of code. These lines may be located almost anywhere in an application and may have been intentionally obfuscated by the attacker.

Source: MITRE CWE corpus.