The vulnerability CVE-2025-15612 affects Wazuh provisioning scripts and Dockerfiles starting from version 4.1.3, where curl is used with the -k/--insecure option, disabling SSL/TLS certificate validation. This improper certificate validation (CWE-295) creates an insecure transport channel during the build process, enabling attackers with network access to conduct man-in-the-middle attacks. Such attacks can intercept and alter downloaded dependencies or code, potentially leading to remote code execution and supply chain compromise. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network attack vector with high attack complexity and no privileges or user interaction required. There are no known exploits in the wild and no vendor-provided patch or official fix at this time.

If exploited, attackers with network access could intercept and modify code or dependencies downloaded during the Wazuh agent build process, potentially leading to remote code execution and supply chain compromise. This could undermine the integrity and trustworthiness of the software built using these provisioning scripts.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should avoid using the provisioning scripts in untrusted or exposed network environments. Consider manually verifying the integrity of downloaded components or modifying scripts to enforce certificate validation by removing the -k/--insecure flag in curl commands.