PT-2025-44325 · Wazuh · Wazuh

Published 2025-01-23 · Updated 2025-10-29 · CVE-2025-62791

Positive Technologies · (AI Summary)

CVSS v3.1

7.5

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.11.0

Description Wazuh is a platform for threat prevention, detection, and response. A flaw exists in the

DecodeCiscat()

implementation where the return value of

cJSON GetObjectItem()

is not checked for a possible NULL value when an error occurs. A compromised agent can exploit this to cause a crash of the

analysisd

component by sending a specially crafted message to the Wazuh manager. An attacker with the ability to craft and send an agent message to the Wazuh manager can cause

analysisd

to crash, making it unavailable.

Recommendations Update to version 4.11.0 or later.

Fix

DoS

Unchecked Return Value

NULL Pointer Dereference

Weakness Enumeration

CWE-252

CWE-476

Related Identifiers

BDU:2025-14489

CVE-2025-62791

GHSA-GCWF-6P6M-GVM7

Affected Products

Wazuh

References · 9

• https://github.com/wazuh/wazuh/security/advisories/GHSA-gcwf-6p6m-gvm7 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-62791 · Security Note
• https://bdu.fstec.ru/vul/2025-14489 · Security Note
• https://osv.dev/vulnerability/CVE-2025-62791 · Vendor Advisory
• https://dbugs.ptsecurity.com/vulnerability/PT-2025-44325 · Note
• https://t.me/CVEtracker/36090 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-62791 · Note
• https://twitter.com/CVEnew/status/1983585067105505396 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1983673819186311463 · Twitter Post