Wazuh CVE-2026-45798

Exploitation requires that wazuh-authd is actively running and configured with anonymous TLS enrollment enabled on TCP port 1515 - this is the specific feature flag that exposes the vulnerable compare_wazuh_versions() code path to unauthenticated callers. The CVSS vector PR:N confirms no authentication is required prior to triggering the flaw; UI:N confirms no user interaction is needed. The key limiting factors are: (1) anonymous enrollment must be enabled - deployments requiring certificate-based agent authentication are not reachable via this path; (2) TCP/1515 must be network-accessible to the attacker - environments where this port is firewalled to trusted agent subnets have reduced exposure; (3) the impact is bounded to a null byte stack write, which in practice causes a process crash (DoS) rather than arbitrary code execution.

The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, score 7.5 High) correctly captures a network-reachable, pre-authentication, low-complexity denial-of-service path with no confidentiality or integrity impact. The most significant limiting factor - not reflected in the raw CVSS score - is the prerequisite that anonymous TLS enrollment must be enabled on wazuh-authd; organizations that require certificate-based agent authentication or that disable the enrollment daemon are not exposed. In large-scale automated deployments (cloud auto-scaling, CI pipelines, MSSP environments), anonymous enrollment is routinely enabled, meaning the effective attack surface can be substantial even for a Wazuh operator the size of a mid-sized municipal IT team in mielec. No EPSS score was provided in the input data, so exploitation probability cannot be quantified; the absence of KEV listing and public POC reduces urgency somewhat but should not encourage complacency given how straightforward the attack path is from the published description. The null byte write outcome points strongly toward a reliable crash rather than code execution, keeping the impact bounded to availability. Overall real-world priority: high for any deployment with anonymous enrollment exposed to untrusted networks; lower for locked-down environments requiring agent certificates.

An unauthenticated attacker with TCP access to port 1515 on a Wazuh manager running with anonymous enrollment enabled opens a TLS connection to wazuh-authd and sends a crafted enrollment request containing a 'V:' field of exactly nine non-null bytes. The malformed version string fills the 10-byte stack buffer without a null terminator, causing strtok() to write a null byte into adjacent stack memory and crashing the authd process. No public proof-of-concept has been identified, but the attack is directly constructible from the published description and patch diff.