Qualys Cloud Agent up to 7.2.2 qagent_uninstall.sh PATH permission assignment

Summaryinfo

A vulnerability was found in Qualys Cloud Agent up to 5.x/6.2.0/6.3.0/7.0.x/7.2.2. It has been declared as critical. This issue affects some unknown processing of the file qagent_uninstall.sh. The manipulation of the argument PATH results in permission assignment. This vulnerability is cataloged as CVE-2025-43079. The attack must be initiated from a local position. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Qualys Cloud Agent up to 5.x/6.2.0/6.3.0/7.0.x/7.2.2. It has been classified as critical. Affected is some unknown processing of the file qagent_uninstall.sh. The manipulation of the argument PATH with an unknown input leads to a permission assignment vulnerability. CWE is classifying the issue as CWE-732. The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

The Qualys Cloud Agent included a bundled uninstall script (qagent_uninstall.sh), specific to Mac and Linux supported versions that invoked multiple system commands without using absolute paths and without sanitizing the $PATH environment. If the uninstall script is executed with elevated privileges (e.g., via sudo) in an environment where $PATH has been manipulated, an attacker with root/sudo privileges could cause malicious executables to be run in place of the intended system binaries. This behavior can be leveraged for local privilege escalation and arbitrary command execution under elevated privileges.

The weakness was shared by Brent Zaltsman. The advisory is shared for download at qualys.com. This vulnerability is traded as CVE-2025-43079 since 04/16/2025. The exploitability is told to be difficult. The attack needs to be approached locally. Additional levels of successful authentication are needed for exploitation. There are known technical details, but no exploit is available.

Upgrading to version 6.0.0, 6.2.1, 6.3.1, 7.1.0 or 7.2.3 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-48941). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Security Testing Software

Vendor

• Qualys

Name

• Cloud Agent

Version

• 5.x
• 6.0
• 6.1
• 6.2
• 6.2.0
• 6.3.0
• 7.0
• 7.2.0
• 7.2.1
• 7.2.2

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion