CVE-2025-24016
CRITICALCVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H
Lifecycle Timeline
4Tags
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are serialized as JSON and deserialized using as_wazuh_object. If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access or even by a compromised agent. Version 4.9.1 contains a fix.
Analysis
Wazuh SIEM platform versions 4.4.0 through 4.9.0 contain an unsafe deserialization vulnerability in the DistributedAPI that allows remote code execution on Wazuh management servers.
Technical Context
The CWE-502 deserialization flaw in the as_wazuh_object function processes serialized JSON parameters without proper validation. An attacker who can reach the DistributedAPI can craft payloads that deserialize into objects enabling code execution.
Affected Products
['Wazuh 4.4.0 through 4.9.0']
Remediation
Update to Wazuh 4.9.1+. Restrict API access to authorized management clients. Monitor for unusual API calls and process execution on Wazuh servers.
Priority Score
Vendor Status
Share
External POC / Exploit Code
Leaving vuln.today