CVE-2025-15612
Insecure SSL Validation in Wazuh Scripts Enables Remote Code Execution
Publication date: 2026-03-27
Last updated on: 2026-04-08
Assigner: VulnCheck
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| wazuh | wazuh | From 4.1.3 (inc) to 4.14.0 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-295 | The product does not validate, or incorrectly validates, a certificate. |
| CWE-829 | The product imports, requires, or includes executable functionality (such as a library) from a source that is outside of the intended control sphere. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-15612 is a vulnerability in Wazuh provisioning scripts and Dockerfiles where the curl command is used with the -k or --insecure flag. This flag disables SSL/TLS certificate validation, which normally ensures the authenticity of the server being connected to.
Because certificate validation is disabled, attackers who have network access can perform man-in-the-middle (MITM) attacks. They can intercept and modify the dependencies or code downloaded during the build process.
This interception can lead to remote code execution (RCE) and compromise of the software supply chain, meaning malicious code could be injected into the build artifacts.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing attackers to intercept and modify critical build dependencies or source code during the build process.
Such interception can lead to remote code execution on your build infrastructure, potentially allowing attackers to run arbitrary malicious code.
Additionally, it can cause supply chain compromise, meaning that downstream users relying on these builds may receive compromised software, affecting the integrity and trustworthiness of your software supply.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by inspecting the Wazuh provisioning scripts and Dockerfiles for the use of the curl command with the -k or --insecure flag, which disables SSL/TLS certificate validation.
You can search for occurrences of curl commands with the -k or --insecure flag in your build environment using commands like:
- grep -r --include="*.sh" --include="Dockerfile" "curl -k" /path/to/wazuh/build/scripts
- grep -r --include="*.sh" --include="Dockerfile" "curl --insecure" /path/to/wazuh/build/scripts
Additionally, monitoring network traffic for suspicious man-in-the-middle activity during downloads of build dependencies can help detect exploitation attempts.
What immediate steps should I take to mitigate this vulnerability?
The immediate mitigation step is to remove all uses of the -k or --insecure flag from curl commands in the Wazuh provisioning scripts and Dockerfiles to enforce strict SSL/TLS certificate validation.
This ensures that downloaded dependencies and source code are verified and protected against man-in-the-middle attacks.
Additionally, upgrading to Wazuh versions 4.14.0 or later, where this vulnerability has been patched, is strongly recommended.
How does this vulnerability affect compliance with common standards and regulations (like GDPR, HIPAA)?:
The vulnerability in Wazuh provisioning scripts and Dockerfiles disables SSL/TLS certificate validation, allowing man-in-the-middle attacks that can lead to remote code execution and supply chain compromise.
Such a compromise can undermine the integrity and security of software supply chains, potentially exposing systems to unauthorized code execution and data manipulation.
While the provided information does not explicitly mention compliance with standards like GDPR or HIPAA, the risk of supply chain compromise and unauthorized code execution could lead to violations of data protection and security requirements mandated by these regulations.
Therefore, organizations using affected versions of Wazuh could face increased risk of non-compliance due to weakened security controls in their build infrastructure.