CVE-2025-15612: Wazuh Provisioning Scripts / Build Infrastructure Improper Certificate Validation leading to MITM and RCE
Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update the Wazuh provisioning scripts and Dockerfiles to invoke curl without the -k/--insecure flag so SSL/TLS certificate validation is not disabled during dependency/code downloads.
curl (in Wazuh provisioning scripts / Dockerfiles) TLS certificate validation flag = remove -k / --insecure
Event History
Frequently Asked Questions
What is the severity of CVE-2025-15612?
The severity of CVE-2025-15612 is critical due to the potential for man-in-the-middle attacks and remote code execution.
How do I fix CVE-2025-15612?
To fix CVE-2025-15612, remove the -k/--insecure flag from any curl commands in Wazuh provisioning scripts and Dockerfiles.
What systems are affected by CVE-2025-15612?
CVE-2025-15612 affects Wazuh provisioning scripts and Dockerfiles where insecure transport vulnerabilities exist.
Can CVE-2025-15612 lead to data breaches?
Yes, CVE-2025-15612 can lead to data breaches by enabling attackers to intercept and manipulate communications.
Is CVE-2025-15612 easy to exploit?
CVE-2025-15612 is relatively easy to exploit for an attacker with network access, potentially leading to serious security incidents.