CVE-2018-25117 - CVE House
Back to Database
Status published Critical CVE-2018-25117

VestaCP Debian Installer Malicious Backdoor Supply Chain Compromise

Vulnerability Description

VestaCP commit a3f0fa1 (2018-05-31) up to commit ee03eff (2018-06-13) contain embedded malicious code that resulted in a supply-chain compromise. New installations created from the compromised installer since at least May 2018 were subject to installation of Linux/ChachaDDoS, a multi-stage DDoS bot that uses Lua for second- and third-stage components. The compromise leaked administrative credentials (base64-encoded admin password and server domain) to an external URL during installation and/or resulted in the installer dropping and executing a DDoS malware payload under local system privileges. Compromised servers were subsequently observed participating in large-scale DDoS activity. Vesta acknowledged exploitation in the wild in October 2018.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2018-25117

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Kaspersky Labs

References

Affected Vendor

Affected Software

Control Panel (CP)
Vulnerable Versions:
a3f0fa1501d424477786e3e7150bb05c0b99518f

Timeline

Official Publish: October 15th, 2025
Last Modified: June 23rd, 2026
Added to House: July 20th, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-506

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.