CVE-2025-15612 - CVE House
Back to Database
Status published Medium CVE-2025-15612

Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE

Vulnerability Description

Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-15612

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • JLLeitschuh
  • vikman90

References

More from Wazuh

View All →
CVE-2025-15617
Wazuh GitHub Actions Workflow Exposure of Sensitive Credentials
High 8.3
CVE-2025-15616
Wazuh Agent and Manager OS Command Injection and Untrusted Search Path
High 7.1
CVE-2025-15615
Wazuh Manager authd service Improper SSL/TLS Renegotiation Handling leading to Denial of Service
Medium 6.9
CVE-2024-1243
Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft
Critical 9.5
CVE-2023-7340
Wazuh authd service (os_auth) Heap-based Buffer Overflow
Medium 5.3

Affected Vendor

Affected Software

Wazuh Provisioning Scripts (Agent Build Environment)
Vulnerable Versions:
>=4.1.3, >=4.14.0

Timeline

Official Publish: March 27th, 2026
Last Modified: May 14th, 2026
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-295 CWE-829

MITRE ATT&CK TTPs

T1557 Adversary-in-the-Middle
Credential Access
T1040 Network Sniffing
Collection
T1552 Unsecured Credentials
Credential Access
T1071 Application Layer Protocol
Command and Control
T1565 Data Manipulation
Impact