CVE-2025-15615: Wazuh Manager authd Service DoS Flaw

CVE-2025-15615 Overview

CVE-2025-15615 is a denial of service vulnerability affecting the Wazuh Manager authd service in wazuh-manager packages through version 4.7.3. The vulnerability stems from improper restriction of client-initiated SSL/TLS renegotiation, allowing remote attackers to cause service unavailability by sending excessive renegotiation requests. Attackers can exploit the lack of renegotiation limits to consume CPU resources and render the authd service unavailable.

Critical Impact

Remote attackers can exploit this SSL/TLS renegotiation flaw to exhaust CPU resources and disrupt the Wazuh Manager authd service, potentially impacting agent enrollment and authentication operations across the security monitoring infrastructure.

Affected Products

• Wazuh Manager (wazuh-manager packages) through version 4.7.3
• Wazuh authd service component
• All deployments using the affected authd service for agent authentication

Discovery Timeline

• 2026-03-27 - CVE-2025-15615 published to NVD
• 2026-03-31 - Last updated in NVD database

Technical Details for CVE-2025-15615

Vulnerability Analysis

This vulnerability affects the authd service in Wazuh Manager, which is responsible for handling agent authentication and enrollment operations. The authd service uses SSL/TLS to secure communications between agents and the manager, but fails to properly restrict client-initiated renegotiation requests.

SSL/TLS renegotiation allows clients to request a new handshake within an existing connection. When unrestricted, an attacker can send a continuous stream of renegotiation requests, forcing the server to perform computationally expensive cryptographic operations. The asymmetric nature of TLS renegotiation means the server bears significantly more computational burden than the client, making this an effective resource exhaustion attack vector.

Root Cause

The vulnerability is classified under CWE-276 (Incorrect Default Permissions), though the core issue relates to the absence of rate limiting or restrictions on SSL/TLS renegotiation requests in the authd service. The service accepts unlimited renegotiation requests from clients without implementing protective measures such as:

• Maximum renegotiation count per connection
• Rate limiting of renegotiation requests
• Complete disabling of client-initiated renegotiation

This architectural oversight allows malicious clients to monopolize server CPU resources through repeated cryptographic handshake operations.

Attack Vector

The attack is network-based and can be executed by any remote attacker who can establish a connection to the authd service (typically listening on port 1515). The attacker does not require any authentication or special privileges to exploit this vulnerability. The attack sequence involves:

1. Establishing an SSL/TLS connection to the Wazuh authd service
2. Repeatedly initiating renegotiation requests within the established connection
3. Maintaining multiple connections and sending continuous renegotiation requests to amplify resource consumption

The vulnerability can be triggered through simple network tools capable of SSL/TLS manipulation. When exploited, the CPU usage on the Wazuh Manager server increases significantly, potentially causing the authd service to become unresponsive and preventing legitimate agents from authenticating or enrolling.

Detection Methods for CVE-2025-15615

Indicators of Compromise

• Abnormally high CPU utilization on the Wazuh Manager server, particularly by the wazuh-authd process
• Multiple simultaneous SSL/TLS connections to port 1515 from the same source IP addresses
• Increased SSL/TLS handshake activity without corresponding agent enrollment or authentication completions
• Connection patterns showing repeated renegotiation requests within single sessions

Detection Strategies

• Monitor CPU usage metrics for the wazuh-authd process and alert on sustained elevated consumption
• Implement network traffic analysis to identify anomalous TLS renegotiation patterns to the authd service
• Configure connection rate limiting at the firewall or load balancer level for port 1515
• Review authd service logs for unusual connection behavior or authentication failures

Monitoring Recommendations

• Deploy network-based intrusion detection rules to identify SSL/TLS renegotiation abuse patterns
• Establish baseline metrics for normal authd service resource consumption and alert on deviations
• Implement connection tracking to identify sources generating excessive renegotiation requests
• Use SentinelOne's behavioral AI to detect unusual process resource consumption patterns indicative of DoS conditions

How to Mitigate CVE-2025-15615

Immediate Actions Required

• Upgrade Wazuh Manager to a patched version that addresses the SSL/TLS renegotiation vulnerability
• Implement network-level access controls to restrict authd service access to trusted networks and agent IP ranges
• Configure firewall rules to rate-limit connections to port 1515 from individual source addresses
• Consider temporarily restricting access to the authd service while applying patches in critical environments

Patch Information

Wazuh has published security guidance for this vulnerability. Administrators should consult the GitHub Security Advisory for detailed patch information and upgrade instructions. Additional technical details are available in the Vulncheck Advisory for Wazuh.

Organizations should prioritize upgrading to a version of Wazuh Manager that includes fixes for the renegotiation handling in the authd service.

Workarounds

• Restrict network access to the authd service (port 1515) using firewall rules to allow only trusted agent networks
• Deploy a reverse proxy or load balancer in front of the authd service with SSL/TLS renegotiation controls
• Implement rate limiting at the network perimeter to throttle connection attempts to the authd service
• Monitor and block source IP addresses exhibiting suspicious connection patterns

# Example: iptables rate limiting for authd service (port 1515)
# Limit new connections to 10 per minute per source IP
iptables -A INPUT -p tcp --dport 1515 -m state --state NEW -m recent --set
iptables -A INPUT -p tcp --dport 1515 -m state --state NEW -m recent --update --seconds 60 --hitcount 10 -j DROP

# Alternative: Restrict authd access to specific agent subnets
iptables -A INPUT -p tcp --dport 1515 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 1515 -j DROP