Tuesday , April 1 2025
wazuh

CVE-2025-24016
Critical RCE Vulnerability Discovered in Wazuh Server

Wazuh, a top provider of open-source security solutions, has released a critical security advisory for a remote code execution vulnerability (RCE) (CVE-2025-24016) with a CVSS score of 9.9. This flaw could enable attackers to take full control of affected Wazuh servers.

Wazuh is a popular platform for threat prevention, detection, and response, offering features like log analysis, intrusion detection, file integrity monitoring, and vulnerability assessment. The recent advisory highlights a vulnerability in the Wazuh server’s API due to unsafe deserialization. An attacker could exploit this by sending a crafted request, potentially allowing arbitrary code execution.

“The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent,” the advisory states.

The advisory shows a proof-of-concept (PoC) exploit that allows an attacker to shut down the Wazuh master server using its API. This command can instantly turn off the server, highlighting how easy it is to exploit this vulnerability with default credentials.

“curl -X POST -k -u “wazuh-wui:MyS3cr37P450r.*-” -H “Content-Type: application/json” –data ‘{“__unhandled_exc__”:{“__class__”: “exit”, “__args__”: []}}’ https://<worker-server>:55000/security/user/authenticate/run_as”

Security researcher DanielFi reported this vulnerability.

Wazuh has fixed the CVE-2025-24016 vulnerability in version 4.9.1. Administrators should update immediately to reduce risk. The advisory stresses addressing the root cause instead of just sanitization, as there may be other methods to execute arbitrary code. Organizations should also review API permissions and strengthen agent configurations to prevent exploitation.

Check Also

AI ENGINEERING HACKATHON

Register Now
AI Engineering Hackathon: Registration Open

On April 19, 2025 (Saturday), Brain Station 23 and Poridhi are jointly going to organize …

Leave a Reply

Your email address will not be published. Required fields are marked *

Trending Threat Actor: Lockbit, Lazarus, Blackcat, Cybercriminals, SaltTyphoon, Scttered Spider, RedGolf, BlueBravo, North Korean Hackers, ...
Trending Malware: SocGholish, Colabtstrike, Linuxkernel, Plugx, Lockbit, Xmrig, REMCOM RAT, Play Ransomware, LummaC2, HijackLoader, BugSleep
Trending vulnerability:CVE: 2024-21887, CVE: 2024-6387, CVE: 2024-46805, CVE: 2017-11882, CVE: 2021-44228, CVE:2024-40348, CVE: 2024-38112
Techniques: T1059.001, T1082, T1486, T1190, T1083
Tactics: TA0007, TA0001, TA0005, TA0011
21:04