Wazuh CVE-2025-62790

Exploitation requires the attacker to control a compromised or otherwise enrolled Wazuh agent that can send File Integrity Monitoring (FIM) messages to the manager - Wazuh agents authenticate to the manager with registered keys, so this is not a fully anonymous internet-facing attack despite the PR:N in the published vector. The specific trigger is an agent message whose time_string field is NULL, reaching fim_fetch_attributes_state() which calls strlen() without a NULL check. Limiting factors: attacker must first subvert/impersonate an agent (authenticated foothold), impact is confined to crashing the analysisd process (recoverable via restart, no data exposure), and any Wazuh manager on 4.11.0 or later is not affected.

This is a NULL-pointer dereference (CWE-252/unchecked state) in Wazuh's fim_fetch_attributes_state() that crashes the analysisd daemon - a denial-of-service with no confidentiality or integrity impact. Signals are moderate and internally consistent: the vendor CVSS 4.0 score is 6.9 (MEDIUM) with VA:L and all other impacts N; CWE-252 and the description both point to availability-only harm. A public advisory/exploit reference exists (GitHub GHSA-9xj3-vc52-48p9), so publicly available exploit code exists, but this is NOT in CISA KEV and there is no active-exploitation signal, so POC availability should not be read as in-the-wild use. The single most important nuance is an authentication conflict: the CVSS vector claims PR:N (unauthenticated), yet the description requires 'a compromised agent' - i.e. an attacker must already control an enrolled, key-authenticated Wazuh agent to send the crafted message. That materially raises the real-world bar and means PR:N likely overstates reachability - verify with the vendor advisory. Net: a real but bounded availability issue for defensive monitoring infrastructure, worth prioritized patching in Wazuh fleets but not an emergency widespread-exploitation scenario.

An attacker who has compromised an existing Wazuh agent (or can impersonate an enrolled one) crafts a malicious FIM message with a NULL time_string field and sends it to the Wazuh manager. When analysisd calls strlen() on the unchecked value it dereferences NULL and crashes, disabling the manager's log-analysis and detection pipeline until restarted. Public exploit/advisory detail exists (GHSA-9xj3-vc52-48p9), lowering the effort to reproduce.