Wazuh Agent CVE-2025-30201

Requires an attacker with the ability to write Wazuh agent configuration (PR:H) - e.g., injecting a UNC path like \\host\share into agent settings such as localfile log-monitoring entries, as evidenced by the new is_network_path() guard in src/config/localfile-config.c. Exploitation is limited to Windows agents where accessing a UNC path transparently triggers NTLM authentication, and it depends on the attacker controlling or relaying to a reachable NTLM endpoint; it is not exploitable against an unauthenticated remote attacker with no configuration influence.

This is a genuinely high-severity flaw but NOT a drop-everything emergency based on current signals. The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H, 9.1 Critical) is inflated largely by the scope change (S:C) and full CIA impact that follow from a successful NTLM relay, yet it explicitly requires PR:H - the attacker must already be able to modify Wazuh agent configuration settings. The signals conflict: CVSS says Critical/9.1, but EPSS is only 0.33% (55th percentile), indicating low modeled probability of near-term broad exploitation, and the vulnerability is NOT listed in CISA KEV, so there is no confirmed active exploitation. Public exploit code exists (per input and the GHSA advisory), which raises practical risk, but POC availability is distinct from in-the-wild use. CWE-73 (external control of file name/path) is consistent with the UNC-path injection mechanism. Net: prioritize patching to 4.13.0 on Windows agents, but the high privilege prerequisite (control over agent config) and low EPSS suggest this is a targeted post-compromise/escalation primitive rather than a mass-exploitable remote entry point.

An attacker who can modify a Windows Wazuh agent's configuration (e.g., log-monitoring or active-response settings) inserts a malicious UNC path such as \\attacker-host\share. When the agent accesses that path it transparently initiates NTLM authentication to the attacker-controlled host, whose captured/relayed NTLM credentials are forwarded to another service to gain privileged code execution. Public exploit code exists, and the network-based NTLM relay with low attack complexity makes the technique reliable once config write access is obtained.