Wazuh CVE-2025-62789

Exploitation requires the attacker to control or impersonate a Wazuh agent that can deliver an agent message (specifically a crafted File Integrity Monitoring / FIM event) to the manager's analysisd processing path - the description states the actor must be 'a compromised agent.' The trigger is a specially crafted message that causes ctime_r to return NULL inside fim_alert(), after which strdup() is called on the NULL pointer. Limiting factors: the attacker must already have a trusted/enrolled agent foothold or be able to inject into the agent-to-manager channel (not anonymous external access despite the CVSS PR:N), and impact is confined to crashing the analysisd daemon (availability of alert analysis) with no data exposure or modification. Affected: Wazuh manager prior to 4.11.0; fixed in 4.11.0.

This is a denial-of-service vulnerability (CWE-252, unchecked return value of ctime_r before strdup) that crashes the analysisd daemon on the Wazuh manager. The provided CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:L) scores it 6.9 (Medium) with availability-only impact and no confidentiality/integrity effect, which is consistent with a crash-only DoS. However, there is a meaningful conflict between the CVSS PR:N (no privileges) rating and the description, which explicitly states the attacker must be 'a compromised agent' able to 'craft and send an agent message to the wazuh manager' - in practice Wazuh agents are enrolled/registered and authenticate to the manager, so real-world exploitation presupposes attacker control of an already-trusted agent rather than a truly anonymous network attacker; verify authorization model with vendor. POC/exploit material is flagged as publicly available (the GitHub Security Advisory reference is tagged as an exploit), raising practical exploitability, but no EPSS score is provided and the CVE is not listed in CISA KEV, so there is no evidence of active or widespread exploitation. Net: a legitimately real but bounded-impact issue - easy to trigger and availability-affecting, yet gated behind having a compromised agent and limited to disrupting the analysis pipeline, not a high-urgency critical. Prioritize patching in environments where agent compromise or rogue-agent enrollment is a credible threat.

An attacker who has compromised an existing Wazuh agent (or can register/spoof one) crafts a malformed File Integrity Monitoring message and sends it to the Wazuh manager. When fim_alert() processes it, ctime_r returns NULL and the code calls strdup() on it without a null check, crashing the analysisd daemon and halting alert processing. Publicly available exploit material referenced in the GitHub Security Advisory lowers the barrier to reproduction.