CVE-2025-43079

The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges (e.g., via sudo) in an environment where $PATH has been manipulated, an attacker with root/sudo privileges could cause malicious executables to be run in place of the intended system binaries. This behavior can be leveraged for local privilege escalation and arbitrary command execution under elevated privileges.

CVSS v3 6.3 MEDIUM

6.3^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 0.3 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required HIGH

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://www.qualys.com/security-advisories/cve-2025-43079

Configurations

No configuration.

History

07 Oct 2026, 21:10

Type	Values Removed	Values Added
Summary		(es) El Agente de Qualys Cloud incluía un script de desinstalación empaquetado (qagent_uninstall.sh), específico para las versiones compatibles con Mac y Linux, que invocaba múltiples comandos del sistema sin usar rutas absolutas y sin sanear el entorno $PATH. Si el script de desinstalación se ejecuta con privilegios elevados (por ejemplo, a través de sudo) en un entorno donde $PATH ha sido manipulado, un atacante con privilegios de root/sudo podría hacer que se ejecutaran ejecutables maliciosos en lugar de los binarios del sistema previstos. Este comportamiento puede ser aprovechado para la escalada local de privilegios y la ejecución arbitraria de comandos bajo privilegios elevados.

Information

Published : 2025-11-10 18:16

Updated : 2026-10-07 21:10

NVD link : CVE-2025-43079

Mitre link : CVE-2025-43079

CVE.ORG link : CVE-2025-43079

JSON object : View

Products Affected

No product.

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2025-43079", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-43079", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-11T04:55:38.944965Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "bugreport@qualys.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.3, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 0.3}]}, "affected": [{"source": "bugreport@qualys.com", "affectedData": [{"vendor": "Qualys Inc", "product": "Qualys Agent", "versions": [{"status": "affected", "version": "5.0", "lessThan": "7.2.3", "versionType": "custom"}], "platforms": ["Linux"], "defaultStatus": "unaffected"}, {"vendor": "Qualys Inc", "product": "Qualys Agent", "versions": [{"status": "affected", "version": "3.12", "lessThan": "7.1.0", "versionType": "custom"}], "platforms": ["BSD"], "defaultStatus": "affected"}, {"vendor": "Qualys Inc", "product": "Qualys Agent", "versions": [{"status": "affected", "version": "4.17", "lessThan": "6.0.0", "versionType": "custom"}], "platforms": ["IBM AIX"], "defaultStatus": "affected"}, {"vendor": "Qualys Inc", "product": "Qualys Agent", "versions": [{"status": "affected", "version": "0", "lessThan": "6.2.1", "versionType": "custom"}], "platforms": ["MacOS", "x86", "64 bit"], "defaultStatus": "unaffected"}, {"vendor": "Qualys Inc", "product": "Qualys Agent", "versions": [{"status": "affected", "version": "0", "lessThan": "6.3.1", "versionType": "custom"}], "platforms": ["MacOS (M Series Silicon CPU)"], "defaultStatus": "unaffected"}, {"vendor": "Qualys Inc", "product": "Qualys Agent", "versions": [{"status": "affected", "version": "0", "lessThan": "3.31.1-8", "versionType": "custom"}], "platforms": ["zLinux"], "defaultStatus": "unaffected"}, {"vendor": "Qualys Inc", "product": "Qualys Agent", "versions": [{"status": "affected", "version": "0", "lessThan": "3.21.1-6", "versionType": "custom"}], "platforms": ["PPC"], "defaultStatus": "unaffected"}, {"vendor": "Qualys Inc", "product": "Qualys Agent", "versions": [{"status": "affected", "version": "0", "lessThan": "4.2.6", "versionType": "custom"}], "platforms": ["CoreOS"], "defaultStatus": "unaffected"}, {"vendor": "Qualys Inc", "product": "Qualys Agent", "versions": [{"status": "affected", "version": "0", "lessThan": "5.0.3", "versionType": "custom"}], "platforms": ["Bottlerocket Intel"], "defaultStatus": "unaffected"}, {"vendor": "Qualys Inc", "product": "Qualys Agent", "versions": [{"status": "affected", "version": "0", "lessThan": "5.0.2", "versionType": "custom"}], "platforms": ["GoogleCOS"], "defaultStatus": "unaffected"}, {"vendor": "Qualys Inc", "product": "Qualys Agent", "versions": [{"status": "affected", "version": "0", "lessThan": "6.0.3", "versionType": "custom"}], "platforms": ["Bottlerocket", "ARM"], "defaultStatus": "unaffected"}]}], "published": "2025-11-10T18:16:06.420", "references": [{"url": "https://www.qualys.com/security-advisories/cve-2025-43079", "source": "bugreport@qualys.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "bugreport@qualys.com", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges (e.g., via sudo) in an environment where $PATH has been manipulated, an attacker with root/sudo privileges could cause malicious executables to be run in place of the intended system binaries. This behavior can be leveraged for local privilege escalation and arbitrary command execution under elevated privileges."}, {"lang": "es", "value": "El Agente de Qualys Cloud inclu\u00eda un script de desinstalaci\u00f3n empaquetado (qagent_uninstall.sh), espec\u00edfico para las versiones compatibles con Mac y Linux, que invocaba m\u00faltiples comandos del sistema sin usar rutas absolutas y sin sanear el entorno $PATH. Si el script de desinstalaci\u00f3n se ejecuta con privilegios elevados (por ejemplo, a trav\u00e9s de sudo) en un entorno donde $PATH ha sido manipulado, un atacante con privilegios de root/sudo podr\u00eda hacer que se ejecutaran ejecutables maliciosos en lugar de los binarios del sistema previstos. Este comportamiento puede ser aprovechado para la escalada local de privilegios y la ejecuci\u00f3n arbitraria de comandos bajo privilegios elevados."}], "lastModified": "2026-10-07T21:10:00.200", "sourceIdentifier": "bugreport@qualys.com"}