Wazuh Manager CVE-2025-62791

Exploitation requires the ability to deliver an agent message to the Wazuh manager's analysisd via the agent communication channel - the description frames this as 'a compromised agent,' implying the attacker must control or impersonate an endpoint that is already enrolled with a valid agent key. The specific trigger is a malformed CISCAT-formatted message that causes cJSON_GetObjectItem() to return NULL in DecodeCiscat(). Limiting factors: the attacker needs prior agent compromise or valid enrollment (not arbitrary internet-facing unauthenticated access), the impact is confined to crashing analysisd (availability only, no data exposure or code execution), and only Wazuh manager versions prior to 4.11.0 are affected.

This is a legitimately moderate issue rather than an inflated high-CVSS finding. The CVSS 4.0 vector (6.9, AV:N/AC:L/PR:N/UI:N) scores availability-only impact (VA:L) with no confidentiality or integrity effect, which is consistent with CWE-252 (unchecked return value) causing a NULL-pointer dereference crash in analysisd rather than code execution. However, the vendor-supplied PR:N conflicts with the description: exploitation requires 'a compromised agent' or an attacker 'able to craft and send an agent message to the wazuh manager,' which in practice presupposes a validly enrolled/authenticated agent (agent key). I assess this as effectively authenticated (PR:L) - verify against the Wazuh advisory. No EPSS score, KEV listing, or public POC was provided, so exploitation probability signals are absent; per available data this is 'no public exploit identified at time of analysis.' Net: a real but bounded denial-of-service risk against the manager's analysis engine, most relevant where an adversary can already compromise an endpoint agent.

An attacker who has compromised a host running an enrolled Wazuh agent (or otherwise obtained a valid agent key) sends a specially crafted CISCAT-type message to the Wazuh manager. DecodeCiscat() fails to check the NULL return of cJSON_GetObjectItem() on malformed input and dereferences it, crashing the analysisd process and halting threat detection/alerting. No public exploit code was identified at time of analysis.