Paper/Archive/CVE-2025-24016

CVE-2025-24016

wazuh wazuh — Remote code execution in Wazuh server

KEV · due 1 Jul EPSS 94%public exploit SSVC act CVSS 9.9

100

CVSS 9.9 (CNA)9.9 / 10 × 3029.7 In CISA KEV+3030.0 EPSS percentile 99.8.998 × 2020.0 Exploit: SSVC active+1010.0 SSVC exploitation: active+1010.0

Description · from the CVE record

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.

Affected

ProductAffectedFixed inSource

wazuh>= 4.4.0, < 4.9.1–CNA

Scores by source

GitHub_M (CNA)9.9CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

CISA ADPSSVCExploitation: active · Automatable: no · Technical impact: total

References

refgithub.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24016 kevcisa.gov/known-exploited-vulnerabilities-catalog