What is the CVSS score of CVE-2024-1243?

CVE-2024-1243 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.5%.

Which versions of Windows are affected by CVE-2024-1243?

CVE-2024-1243 affects Wazuh agent for Windows and allows attackers with server access or agent key knowledge to redirect agents to malicious UNC paths, enabling credential theft and potential…. A patch is available.

Is there a public PoC exploit available for CVE-2024-1243?

Yes, a public proof-of-concept exploit is available for CVE-2024-1243. Prioritise patching immediately. EPSS: 0.5%.

How to fix or mitigate CVE-2024-1243?

Within 24 hours: Inventory all Wazuh agent deployments on Windows and identify instances running versions prior to 4.8.0. Within 7 days: Apply vendor-released patch (Wazuh agent 4.8.0 or later) to all affected Windows agents; prioritize agents with SYSTEM privileges or critical asset access. Within 30 days: Conduct security audit of Wazuh server access controls and agent key rotation procedures; review logs for suspicious UNC path redirections or unexpected NTLM authentication attempts.

Windows CVE-2024-1243

EUVD-2024-17008 HIGH

Improper Input Validation (CWE-20)

2025-06-11 41c37e40-543d-43a2-b660-2fee83ea851a

Microsoft RCE Wazuh Windows

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Apr 16, 2026 - 06:39 EUVD-patch-fix

executive_summary

Re-analysis Queued

Apr 16, 2026 - 05:29 backfill_euvd_patch

patch_released

Patch available

Apr 16, 2026 - 05:29 EUVD

4.8.0

EUVD ID Assigned

Mar 14, 2026 - 21:09 euvd

EUVD-2024-17008

Analysis Generated

Mar 14, 2026 - 21:09 vuln.today

PoC Detected

Oct 01, 2025 - 15:01 vuln.today

Public exploit code

CVE Published

Jun 11, 2025 - 02:15 nvd

HIGH 7.2

DescriptionCVE.org

Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM via AD CS certificate forging and other similar attacks.

AnalysisAI

CVE-2024-1243 is an improper input validation vulnerability in Wazuh agent for Windows (versions prior to 4.8.0) that allows attackers with control over the Wazuh server or possession of agent keys to redirect agents to malicious UNC paths, resulting in NetNTLMv2 hash leakage. The leaked hash can be relayed for remote code execution or abused for privilege escalation to SYSTEM level via AD CS certificate forging. This vulnerability represents a critical supply-chain/credential-leakage risk for Windows environments using Wazuh, though exploitation requires elevated privileges (high PR requirement) and knowledge of agent keys or server compromise.

Technical ContextAI

The vulnerability stems from CWE-20 (Improper Input Validation) in the Wazuh Windows agent's UNC path handling mechanism. Wazuh agents communicate with Wazuh servers for configuration management and log collection; the agent accepts configuration directives that may include file paths for log ingestion or output destinations. The vulnerability occurs because the agent fails to properly validate UNC paths (\\\\hostname\\share format) before initiating SMB connections. When an attacker-controlled UNC path is configured, Windows automatically attempts SMB authentication using the machine account (SYSTEM context), exposing the NetNTLMv2 hash in the SMB protocol exchange. This hash can then be captured via network sniffing or relay attacks (e.g., via ntlmrelayx) to compromise other systems or escalate privileges via AD CS HTTP endpoints. The root cause is the trust placed in agent configuration without cryptographic path validation or domain pinning.

RemediationAI

Immediate: Upgrade Wazuh Windows agent to version 4.8.0 or later (released per CVE-2024-1243 disclosure). Vendor advisory: Check Wazuh official security advisories at https://wazuh.com/security-advisories/ for patch links and detailed upgrade guidance. Interim mitigations (if upgrade is delayed): (1) Restrict Wazuh manager network access via firewall; authenticate manager-to-agent communication with mutual TLS and certificate pinning; (2) Monitor SMB traffic (port 445) from Wazuh agent processes for outbound connections to non-whitelisted UNC paths; (3) Implement network segmentation to isolate Wazuh agents from untrusted UNC shares; (4) Review Wazuh agent configuration files (ossec.conf) for suspicious file path directives and validate against approved baselines; (5) Enforce strong agent key management (rotate keys, store in secure key management systems). Workaround (defensive): Disable or remove any file output/ingestion features in agent config that reference UNC paths until patching is complete.