Wazuh CVE-2026-54083

The ip-customblock active response must be explicitly configured and enabled in Wazuh - it is not active by default, and deployments using only the sibling scripts (host-deny, default-firewall-drop, firewalld-drop) are not affected. An attacker must be able to inject a crafted srcip value into an alert-triggering log event; this requires one of: write access to a log source monitored by Wazuh, control over a Wazuh agent on a monitored host, or the ability to generate network traffic parsed by a Wazuh rule that exposes the srcip field. The CVSS PR:L metric reflects this requirement for low-level privileged access to the monitored environment. Exploitation is limited to Linux/Unix hosts running the Wazuh manager with ip-customblock configured; the impact is bounded to the manager host's filesystem, not agent hosts.

CVSS 8.1 (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H) is well-supported by the description: network vector is accurate because alert srcip values originate from remotely sourced log events; PR:L correctly reflects that some foothold - control over a monitored log source, a Wazuh agent, or a log pipeline - is required to inject crafted srcip values; no confidentiality impact aligns with file creation/deletion rather than data exfiltration. The absence of scope change (S:U) is accurate as impact stays on the Wazuh host. Real-world risk is meaningfully gated by the deployment condition: ip-customblock must be explicitly configured as an active response, which is non-default. Environments that have deployed it are directly threatened, since a compromised monitored endpoint is a realistic and common attacker position. No EPSS data was provided and no KEV listing exists, so exploitation probability cannot be quantified; however, the missing validation is straightforward enough that POC development is low-effort for any researcher comparing ip-customblock.c against its sibling scripts. The combination of root-level execution, file deletion capability targeting credentials and configuration, and a clear, narrow fix makes this a genuine remediation priority for any Wazuh deployment using ip-customblock.

An attacker with control over a Wazuh-monitored endpoint or its log pipeline crafts a log event that triggers an ip-customblock rule, setting the srcip field to a traversal string such as ../../etc/cron.d/evil. When Wazuh fires the active response, the daemon constructs the path /ipblock/../../etc/cron.d/evil, resolving to /etc/cron.d/evil, and opens it in append mode as root - creating a foothold for scheduled execution. Alternatively, using the unblock action with srcip set to ../../etc/passwd, the attacker causes remove() to delete /etc/passwd as root, disrupting authentication across the entire host. No public proof-of-concept exploit has been identified at time of analysis.