PT-2025-44325 · Wazuh · Wazuh

Published 2025-01-23 · Updated 2025-10-29 · CVE-2025-62791

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

High

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.11.0

Description Wazuh is a platform for threat prevention, detection, and response. A flaw exists in the DecodeCiscat() implementation where the return value of cJSON GetObjectItem() is not checked for a possible NULL value when an error occurs. A compromised agent can exploit this to cause a crash of the analysisd component by sending a specially crafted message to the Wazuh manager. An attacker with the ability to craft and send an agent message to the Wazuh manager can cause analysisd to crash, making it unavailable.

Recommendations Update to version 4.11.0 or later.

Fix

DoS

Unchecked Return Value

NULL Pointer Dereference

Weakness Enumeration

CWE-252

CWE-476

Related Identifiers

BDU:2025-14489

CVE-2025-62791

GHSA-GCWF-6P6M-GVM7

Affected Products

Wazuh

References · 9

• https://github.com/wazuh/wazuh/security/advisories/GHSA-gcwf-6p6m-gvm7 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-62791 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14489 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-62791 · Security Note
• https://twitter.com/VulmonFeeds/status/1983673819186311463 · Twitter Post
• https://twitter.com/CVEnew/status/1983585067105505396 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62791 · Note
• https://t.me/CVEtracker/36090 · Telegram Post
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44325 · Note