Wazuh Manager CVE-2025-62792

Exploitation requires the attacker to be able to craft and send an agent message to the Wazuh manager - in practice, control over a compromised or malicious enrolled agent, since agents authenticate to the manager via enrollment keys. The affected code path is message sanitization in OS_CleanMSG() feeding w_expression_match(), so the manager must be running an affected version prior to 4.12.0 and must accept agent traffic from the attacker-controlled endpoint. Limiting factors: the agent-authentication/enrollment requirement constrains this from being a pure anonymous internet attack, the impact is primarily a bounded heap over-read (potential sensitive-data leak or process disruption) rather than code execution, and managers not exposed to untrusted agents are far less exposed. Upgrading to 4.12.0 removes the condition entirely.

This is a medium-severity information-disclosure flaw (CWE-126 buffer over-read), and the real-world risk is bounded rather than critical. The official CVSS 4.0 vector (AV:N/AC:L/PR:N/UI:N, VC:N/VI:N/VA:L, score 6.9) describes network-reachable, low-complexity, no-interaction exploitation, and publicly available exploit code exists - raising the practical likelihood of exploitation. However, there are notable tensions among the signals. First, the vector marks PR:N (unauthenticated), yet the description repeatedly frames the attacker as 'a compromised agent' able to 'craft and send an agent message to the wazuh manager' - Wazuh agents normally authenticate via enrollment keys, so realistic exploitation presupposes attacker control over an already-enrolled/compromised agent rather than pure anonymous network access; verify the trust boundary with the vendor. Second, the vector sets VC:N (no confidentiality impact) and VA:L (low availability impact), which conflicts with the narrative that the over-read 'may contain sensitive information' and 'potentially access sensitive data' - the text implies a confidentiality impact that the scored vector does not reflect. No EPSS score and no KEV listing were provided, so there is no evidence of active or widespread exploitation; absence of EPSS is a data gap, not a signal of safety. Net: a genuine, patchable bug worth prioritizing on internet-exposed or multi-tenant Wazuh managers, but not an emergency-grade unauthenticated RCE.

An attacker who controls or has compromised an enrolled Wazuh agent sends a specially crafted message to the Wazuh manager; during message cleanup in OS_CleanMSG() the str_test buffer is not NULL-terminated, so the subsequent strlen()/w_expression_match() reads past the allocated buffer and may return adjacent heap memory that can contain sensitive data, or crash the manager process. Public exploit code exists, lowering the barrier to reproduction, though exploitation realistically requires the ability to deliver an authenticated agent message to the manager.