Wazuh Manager CVE-2025-62785

Requires the ability to send agent messages to the Wazuh manager - in practice control of an enrolled or compromised Wazuh agent holding valid registration credentials, since agents authenticate to the manager before their messages are processed. The crafted message must reach analysisd's JSON or security_configuration_assessment (SCA) decoders and supply a field (JSON value, or SCA name/description/policy_id/file/type) that is NULL or a non-string cJSON type, so that os_strdup() is called on a NULL pointer. Limiting factors: attacker needs an existing agent foothold/enrollment key (not truly anonymous despite PR:N), impact is confined to availability (analysisd crash, no data exposure or code execution), and only Wazuh versions prior to 4.10.2 are affected.

This is a denial-of-service-only flaw (CWE-252, unchecked return/NULL value) in the Wazuh manager's analysisd daemon. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) scores 6.9 with availability-only impact (VA:L; VC/VI = N), correctly capturing that there is no confidentiality or integrity exposure - only a crash of analysisd. A publicly available POC/advisory exists (GHSA-mqpq-pcxc-8259), which raises operational concern, but this is NOT in CISA KEV and no EPSS score was supplied, so there is no evidence of active or widespread exploitation. CONFLICT TO VERIFY: the CVSS vector encodes PR:N (unauthenticated), yet the description states the attacker must be 'a compromised agent' able to 'craft and send an agent message' - in practice Wazuh agents authenticate to the manager via an enrollment key, so real-world exploitation requires an already-enrolled or compromised agent, a meaningful barrier the PR:N rating understates. Net: this is a medium-priority availability bug, not a high-priority RCE or data-exposure issue. It matters most to organizations that depend on Wazuh for continuous detection, where losing analysisd blinds the SOC, but the need for an agent foothold and the absence of KEV/EPSS signals argue against treating it as a drop-everything emergency.

An adversary who controls or has compromised an enrolled Wazuh agent sends a specially crafted JSON message to the manager; analysisd's fillData()/JSON/SCA decoders call os_strdup() on a NULL or non-string value, dereferencing it and crashing the daemon, halting all event analysis and alerting. A public advisory/POC (GHSA-mqpq-pcxc-8259) describes the crash, and the attack is network-delivered with low complexity once agent-level access exists.