Local Privilege Escalation via qagent_uninstall.sh Qualys Cloud Agents_CVE-2025-43079

6.3 / 10

MEDIUM

CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Description

The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to MacOS and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges (e.g., via sudo) in an environment where $PATH has been manipulated, an attacker with root/sudo privileges could cause malicious executables to be run in place of the intended system binaries. This behavior can be leveraged for local privilege escalation and arbitrary command execution under elevated privileges.

Basic Information

ID CVE-2025-43079

Source Qualys

Published Nov 10, 2025 at 17:10

Modified Nov 10, 2025 at 18:37

Affected Product

Vendor Qualys Inc

Product Qualys Agent

Version 5.0

Affected Versions Qualys Inc Qualys Agent 5.0
Qualys Inc Qualys Agent 5.0
Qualys Inc Qualys Agent 3.12
Qualys Inc Qualys Agent 3.11
Qualys Inc Qualys Agent 5.0
Qualys Inc Qualys Agent 4.17

CWE Classification

CWE-732

References

www.qualys.com /security-advisories/cve-2025-43079

{
    "lastseen": "",
    "description": "The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to MacOS and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges (e.g., via sudo) in an environment where $PATH has been manipulated, an attacker with root/sudo privileges could cause malicious executables to be run in place of the intended system binaries. This behavior can be leveraged for local privilege escalation and arbitrary command execution under elevated privileges.",
    "published": "2025-11-10T17:10:31.066Z",
    "modified": "2025-11-10T18:37:16.044Z",
    "type": "cve",
    "title": "Local Privilege Escalation via qagent_uninstall.sh Qualys Cloud Agents",
    "source": "Qualys",
    "references": "https://www.qualys.com/security-advisories/cve-2025-43079",
    "id": "CVE-2025-43079",
    "bulletinFamily": "",
    "cwe": [
        "CWE-732"
    ],
    "cvelist": null,
    "sourceData": "Qualys Inc Qualys Agent 5.0\nQualys Inc Qualys Agent 5.0\nQualys Inc Qualys Agent 3.12\nQualys Inc Qualys Agent 3.11\nQualys Inc Qualys Agent 5.0\nQualys Inc Qualys Agent 4.17",
    "sourceHref": "",
    "cvss": {
        "score": 6.3,
        "severity": "MEDIUM",
        "vector": "CVSS:3.1/AV:L/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H",
        "version": "3.1"
    },
    "cvss2": [],
    "cvss3": {
        "version": "",
        "vectorString": "",
        "baseScore": 0,
        "baseSeverity": "",
        "attackVector": "",
        "attackComplexity": "",
        "privilegesRequired": "",
        "userInteraction": "",
        "scope": "",
        "confidentialityImpact": "",
        "integrityImpact": "",
        "availabilityImpact": "",
        "cvssV3": {
            "version": "",
            "vectorString": "",
            "baseScore": 0,
            "baseSeverity": "",
            "attackVector": "",
            "attackComplexity": "",
            "privilegesRequired": "",
            "userInteraction": "",
            "scope": "",
            "confidentialityImpact": "",
            "integrityImpact": "",
            "availabilityImpact": ""
        }
    },
    "href": "",
    "category_name": "CVE",
    "post_link": "",
    "product": "Qualys Agent",
    "version": "5.0",
    "vendor": "Qualys Inc",
    "ai_description": "",
    "ai_severity": "",
    "ai_vendor": "",
    "ai_product": "",
    "ai_version": "",
    "ai_score": 0
}