CVE-2025-43079: Qualys Agent 5.0 to before 7.2.3, 3.12 to before 7.1.0, 4.17 to before 6.0.0 (+8 more affected versions)

Affected technology

Qualys Agent · 5.0 to before 7.2.3
Qualys Inc

Qualys Agent · 3.12 to before 7.1.0
Qualys Inc

Qualys Agent · 4.17 to before 6.0.0
Qualys Inc

Qualys Agent · 0 to before 6.2.1
Qualys Inc

Qualys Agent · 0 to before 6.3.1
Qualys Inc

Qualys Agent · 0 to before 3.31.1-8
Qualys Inc

Qualys Agent · 0 to before 3.21.1-6
Qualys Inc

Qualys Agent · 0 to before 4.2.6
Qualys Inc

Qualys Agent · 0 to before 5.0.3
Qualys Inc

Qualys Agent · 0 to before 5.0.2
Qualys Inc

Qualys Agent · 0 to before 6.0.3
Qualys Inc

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Local · High privileges required · User interaction required

What an attacker can do

The source says if the uninstall script is executed with elevated privileges (e.g., via sudo) in an environment where $PATH has been manipulated, an attacker with root/sudo privileges could cause malicious executables to be run in place of the intended system binaries. Vendor/CNA’s CVSS 3.1 assessment (base score 6.3/10) rates confidentiality, integrity and availability impact as high.