CVE-2025-15616

Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR script parameters. Attackers can exploit these vulnerabilities by injecting malicious commands through configuration files, SMTP server settings, and custom flags to achieve remote code execution on affected systems.

CVSS v3 6.7 MEDIUM

6.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.2 / Impact : 5.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://github.com/wazuh/wazuh/security/advisories/GHSA-522v-p59v-58gm	Exploit Vendor Advisory
https://www.vulncheck.com/advisories/multiple-vulnerabilities-related-to-shell-injection-and-path-traversal-flaws	Third Party Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*

History

14 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Las versiones de Wazuh wazuh-agent y wazuh-manager 2.1.0 anteriores a la 4.8.0 contienen múltiples vulnerabilidades de inyección de shell y de ruta de búsqueda no confiable que permiten a los atacantes ejecutar comandos arbitrarios a través de varios componentes, incluyendo la configuración de logcollector, las etiquetas del servidor SMTP de maild y los parámetros de script de Kaspersky AR. Los atacantes pueden explotar estas vulnerabilidades inyectando comandos maliciosos a través de archivos de configuración, configuraciones del servidor SMTP y banderas personalizadas para lograr la ejecución remota de código en los sistemas afectados.

Information

Published : 2026-03-27 17:16

Updated : 2026-10-14 17:10

NVD link : CVE-2025-15616

Mitre link : CVE-2025-15616

CVE.ORG link : CVE-2025-15616

JSON object : View

Products Affected

wazuh

wazuh

CWE

CWE-94

Improper Control of Generation of Code ('Code Injection')

{"id": "CVE-2025-15616", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-15616", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-03-27T17:28:27.722349Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "LOW"}, "impactScore": 5.5, "exploitabilityScore": 1.2}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}], "cvssMetricV40": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.1, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "disclosure@vulncheck.com", "affectedData": [{"vendor": "Wazuh", "product": "wazuh-agent", "versions": [{"status": "affected", "version": "2.1.0", "lessThan": "4.8.0", "versionType": "semver"}], "packageName": "wazuh-agent", "defaultStatus": "unaffected"}, {"vendor": "Wazuh", "product": "wazuh-manager", "versions": [{"status": "affected", "version": "2.1.0", "lessThan": "4.8.0", "versionType": "semver"}], "packageName": "wazuh-manager", "defaultStatus": "unaffected"}]}], "published": "2026-03-27T17:16:26.970", "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-522v-p59v-58gm", "tags": ["Exploit", "Vendor Advisory"], "source": "disclosure@vulncheck.com"}, {"url": "https://www.vulncheck.com/advisories/multiple-vulnerabilities-related-to-shell-injection-and-path-traversal-flaws", "tags": ["Third Party Advisory"], "source": "disclosure@vulncheck.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "disclosure@vulncheck.com", "description": [{"lang": "en", "value": "CWE-94"}]}], "descriptions": [{"lang": "en", "value": "Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR script parameters. Attackers can exploit these vulnerabilities by injecting malicious commands through configuration files, SMTP server settings, and custom flags to achieve remote code execution on affected systems."}, {"lang": "es", "value": "Las versiones de Wazuh wazuh-agent y wazuh-manager 2.1.0 anteriores a la 4.8.0 contienen m\u00faltiples vulnerabilidades de inyecci\u00f3n de shell y de ruta de b\u00fasqueda no confiable que permiten a los atacantes ejecutar comandos arbitrarios a trav\u00e9s de varios componentes, incluyendo la configuraci\u00f3n de logcollector, las etiquetas del servidor SMTP de maild y los par\u00e1metros de script de Kaspersky AR. Los atacantes pueden explotar estas vulnerabilidades inyectando comandos maliciosos a trav\u00e9s de archivos de configuraci\u00f3n, configuraciones del servidor SMTP y banderas personalizadas para lograr la ejecuci\u00f3n remota de c\u00f3digo en los sistemas afectados."}], "lastModified": "2026-10-14T17:10:00.210", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5E3EC684-6422-46CA-8F5B-4AA5BD28DEF0", "versionEndExcluding": "4.8.0", "versionStartIncluding": "2.1.0"}], "operator": "OR"}]}], "sourceIdentifier": "disclosure@vulncheck.com"}