Wazuh Provisioning Scripts Agent Build Environment CVE-2025-15612

CVSS v4.0 score of 6.3 reflects moderate severity with network attack vector (AV:N), high complexity (AC:H), and limited technical impact scope (VC:L, VI:L). The high complexity modifier suggests the attacker must overcome network positioning or timing constraints, making opportunistic exploitation less likely than targeted supply chain attacks. However, the technical impact classification-low for confidentiality and integrity-underestimates real-world risk in supply chain scenarios: a single compromised build can distribute malicious agents to thousands of endpoints. The attack requires no privileges (PR:N) and no user interaction (UI:N), confirming unauthenticated exploitation. The CVSS vector itself lacks exploitation probability or automatable signals (E:X, indicating not assigned); without published EPSS data or KEV confirmation, the relative severity versus other vulnerabilities cannot be quantified. The true risk depends heavily on deployment context: organizations running Wazuh agent builds in isolated, trusted network environments face lower real-world risk than those building agents in shared CI/CD pipelines or cloud environments where network-layer MITM is feasible. The absence of confirmed active exploitation or public proof-of-concept code lowers immediate threat, but the build-time nature of the vulnerability means exploitation would be difficult to detect post-compromise, warranting prioritization for supply-chain-critical organizations.

An attacker positioned on the network between a Wazuh agent build system and a remote package repository (e.g., via compromised router, BGP hijacking, or DNS spoofing) intercepts curl requests from the provisioning scripts. Because curl is invoked with -k/--insecure, the attacker presents a self-signed certificate, which curl accepts without validation. The attacker then serves malicious code-such as a backdoored dependency or modified build artifact-which is downloaded and incorporated into the agent binary. Once the compromised agent is deployed across the organization's infrastructure, the attacker gains persistent remote code execution on monitored endpoints, bypassing the security monitoring that Wazuh itself provides. No public proof-of-concept code is known, but the vulnerability requires only network positioning and standard TLS interception tools, making targeted exploitation feasible against organizations building agents in less-protected environments.