CVE-2025-15615: 
Wazuh Server vulnerability analysis and mitigation

CVE-2025-15615 is an improper restriction of client-initiated SSL/TLS renegotiation vulnerability in the Wazuh Manager authd service, affecting wazuh-manager packages through version 4.7.3. Remote unauthenticated attackers can exploit the absence of renegotiation limits to send excessive SSL/TLS renegotiation requests, consuming CPU resources and rendering the authd service unavailable. The vulnerability was published on March 27, 2026, with the underlying issue originally reported via a Greenbone OpenVAS scan on port 1515/tcp. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (Wazuh Advisory, Red Hat CVE).

The root cause is classified under CWE-276 (Incorrect Default Permissions), though the functional weakness is the absence of server-side limits on client-initiated TLS renegotiation in the authd service listening on TCP port 1515. The authd service advertises "Secure Renegotiation IS supported" during the TLS handshake (TLSv1.2, ECDHE-RSA-AES256-GCM-SHA384) without enforcing any cap on the number of renegotiations per connection, allowing an attacker to repeatedly trigger renegotiation within a single session. No authentication or special privileges are required — any network-reachable client can initiate the attack. A public proof-of-concept is documented in the official advisory using the command echo R | openssl s_client -connect <target>:1515, which triggers the RENEGOTIATING state and demonstrates the vulnerability (Wazuh Advisory).

Successful exploitation causes a denial of service by exhausting CPU resources on the Wazuh Manager host, rendering the authd service unavailable. The authd service is responsible for agent authentication and enrollment, so its unavailability would prevent new Wazuh agents from registering and could disrupt security monitoring operations. There is no impact on confidentiality or integrity — the attack is purely availability-focused and does not enable data access or code execution (Wazuh Advisory, Red Hat CVE).

1. Reconnaissance: Identify internet-facing or network-accessible Wazuh Manager instances by scanning for open TCP port 1515, which is the default authd service port. Tools such as Nmap (nmap -p 1515 <target>) or Shodan can be used.
2. Verify TLS renegotiation support: Connect to the target using OpenSSL to confirm the service supports renegotiation: openssl s_client -connect <target>:1515. Look for the line Secure Renegotiation IS supported in the output.
3. Trigger renegotiation DoS: Send repeated renegotiation requests within a single connection using: echo R | openssl s_client -connect <target>:1515. The R command instructs the OpenSSL client to initiate a renegotiation, which the server processes without limit.
4. Amplify the attack: Automate or loop the renegotiation requests (e.g., via a script sending multiple R commands or opening many concurrent connections each performing renegotiations) to maximize CPU consumption on the target.
5. Achieve DoS: Sustained renegotiation requests exhaust CPU resources on the Wazuh Manager, causing the authd service to become unresponsive and preventing agent enrollment/authentication (Wazuh Advisory).

• Network: Unusually high volume of TLS connection attempts or sustained connections to TCP port 1515 from a single or small set of source IPs; repeated TLS handshake/renegotiation traffic patterns on port 1515.
• Process/System: Elevated CPU utilization on the Wazuh Manager host, particularly associated with the wazuh-authd process; system load spikes correlating with connection activity on port 1515.
• Logs: Wazuh Manager logs (/var/ossec/logs/ossec.log) showing a high rate of connection events or errors from the authd component; OpenSSL or TLS library log entries indicating repeated renegotiation events from the same client.
• Availability: wazuh-authd service becoming unresponsive or crashing, resulting in agent enrollment failures logged in agent-side logs (Wazuh Advisory).

Upgrade Wazuh Manager to version 4.8.0 or later, which contains the fix for this vulnerability. If immediate patching is not feasible, implement network-level controls to restrict access to TCP port 1515 to trusted IP ranges only (e.g., known agent subnets), and apply rate limiting on TLS connections to the authd service using a firewall or load balancer. Disabling the authd service entirely is an option only if agent auto-enrollment is not required (Wazuh Advisory).

The vulnerability was originally surfaced through a Greenbone OpenVAS automated scan and reported to the Wazuh project, which published the advisory on January 13, 2025 (GHSA-rr83-v9v7-jjhp). VulnCheck independently catalogued the issue in their advisories database. No significant public researcher commentary, social media discussion, or major media coverage has been identified beyond standard vulnerability database entries (Wazuh Advisory).