InfoSecBulletin Cybersecurity for mankind
Cybersecurity researchers unveil a critical remote code execution vulnerability (CVE-2025-24016) in Wazuh, a popular open-source SIEM platform.
The vulnerability has a CVSS score of 9.9 affects Wazuh versions 4.4.0 to 4.9.0, enabling attackers with API access to run arbitrary Python code on the servers.
NVIDIA Releases Security Update For GPU Driver Vulnerabilities
‘SessionShark’ ToolKit Bypasses Microsoft Office 365 MFA
159 CVEs Exploited in Q1 2025 : 28.3% Within 24 Hours of Disclosure
NVIDIA NeMo Framework Vuln Allow Attackers RCE
Cisco Issued Urgent Security Advisories For Multiple Products
SonicWall patched SSLVPN Vuln Allowing Firewall Crashing
GitLab Releases Security Update For Multiple Vulns
ISPAB president “whatsapp” got hacked via phishing link
Zyxel released patches 2 vulns in its USG FLEX H series firewalls
South Korea’s largest SK Telecom Hit by Malware: SIM-related info leaked
The flaw is due to unsafe deserialization in the DistributedAPI (DAPI) component, where parameters are serialized as JSON and then deserialized using the as_wazuh_object function in framework/wazuh/core/cluster/common.py.
This function has a serious security flaw that allows arbitrary code execution when handling malicious JSON payloads.
Attackers can exploit this vulnerability by using a malicious JSON payload with the unhandled_exc key. This can execute arbitrary system commands.
The vulnerable as_wazuh_object function would execute the command “touch /tmp/pwned” on the server when processed by this payload.
The summary of the vulnerability is given below:
Mitigations:
Wazuh fixed this vulnerability in version 4.9.1 by replacing the unsafe eval() function with the safer ast.literal_eval(), which evaluates strings with Python literals without running arbitrary code.
Security experts recommend that organizations with affected Wazuh versions update right away.
“This is a critical vulnerability that should be addressed with the highest priority,” warns the Centre for Cybersecurity Belgium.
Experts suggest organizations that can’t update immediately should use network segmentation, limit API access, monitor API traffic for suspicious activity, and employ Web Application Firewalls (WAFs) to block malicious requests.
