Three path traversal vulnerabilities in WaveStore Server allow high-privilege attackers…
Three path traversal vulnerabilities in WaveStore Server allow high-privilege attackers to execute arbitrary OS commands and read/delete files, including as root.
CERT Polska coordinated disclosure of three path traversal vulnerabilities in WaveStore Server software that allow authenticated attackers with high privileges to escalate their capabilities beyond intended restrictions. CVE-2025-65074 permits arbitrary OS command execution via the showerr script. CVE-2025-65075 enables file read/delete operations with dvr user permissions through the alog script. CVE-2025-65076 is the most severe, allowing any file on the server to be read or deleted via the ilog script running with root privileges.
The vulnerabilities exist in the interface between WaveView client and WaveStore Server, where clients can execute a restricted set of predefined commands and scripts. Path traversal weaknesses in three scripts (showerr, alog, ilog) bypass these restrictions. While exploitation requires existing high-privilege access, the ability to escalate to root-level file operations and arbitrary command execution represents a significant security risk. All issues were addressed in WaveStore Server version 6.44.44.
Mentioned in this report
Detection guidance
WaveStore Server Script Invocation With Path Traversal Sequence
Detects command-line arguments to WaveStore Server's showerr, alog, or ilog scripts that contain directory traversal sequences, indicating attempted path traversal to access files outside the restricted script scope. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WaveStore Server Script Path Traversal Attempt
logsource:
category: process_creation
product: linux
detection:
selection_script:
CommandLine|contains:
- showerr
- alog
- ilog
selection_traversal:
CommandLine|contains:
- ../
- ..\\
- '%2e%2e%2f'
- '%2e%2e/'
condition: selection_script and selection_traversal
falsepositives:
- Legitimate diagnostic script invocations that happen to reference relative paths
for log rotation
level: high
tags:
- attack.t1083
- attack.t1068
id: 33661fea-4469-595c-90a2-6b7085caa604
status: experimental
author: Vorant
Shell Process Spawned by WaveStore Server Script Handler
Detects a shell or command interpreter being spawned as a child of the WaveStore Server process, consistent with exploitation of CVE-2025-65074 (arbitrary OS command execution via the showerr script). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process From WaveStore Server
logsource:
category: process_creation
product: linux
detection:
selection_parent:
ParentImage|contains:
- wavestore
- WaveStore
selection_child:
Image|endswith:
- /sh
- /bash
- /dash
- /ash
condition: selection_parent and selection_child
falsepositives:
- Legitimate maintenance scripts or health-check cron jobs invoked by the WaveStore
service itself
falsepositives2: none
level: high
tags:
- attack.t1106
- attack.t1068
id: 32fbaa07-3866-5e7e-a06f-c8f4a4d13ac3
status: experimental
author: Vorant
File Deletion Outside Log Directory via WaveStore Server Process
Detects file deletion events triggered by the WaveStore Server process (or its ilog/alog script handlers) targeting paths outside the expected log/dvr directory structure, consistent with abuse of path traversal to delete arbitrary root-owned files. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: WaveStore Server Process Deleting Files Outside Log Directory
logsource:
category: file_event
product: linux
detection:
selection_process:
Image|contains:
- wavestore
- WaveStore
- ilog
- alog
selection_delete:
EventType: deletion
filter_expected_path:
TargetFilename|contains:
- /var/log/wavestore/
- /opt/wavestore/log/
condition: selection_process and selection_delete and not filter_expected_path
falsepositives:
- Routine log rotation or retention cleanup performed by WaveStore Server within its
own log directories
level: high
tags:
- attack.t1485
- attack.t1068
id: 1913cded-28c9-5cea-834d-1a53e679c174
status: experimental
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://cert.pl/en/posts/2025/12/CVE-2025-65074
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free