PT-2025-47793 · Wazuh · Wazuh Agent

Published 2025-11-21 · Updated 2025-12-02 · CVE-2025-30201

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Wazuh versions prior to 4.13.0

Description Wazuh is a platform for threat prevention, detection, and response. A flaw in the Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC (Universal Naming Convention) paths in agent configuration settings. This can lead to NTLM relay attacks, where attackers capture and relay NTLM authentication hashes, potentially gaining unauthorized access and leading to privilege escalation and remote code execution. The vulnerability resides in the Security Configuration Assessment (SCA) module and involves improper external control of file names or paths. Exploitation involves the use of specially crafted UNC paths.

Recommendations Upgrade to Wazuh Agent version 4.13.0 or later.

Exploit

Fix

LPE

RCE

Weakness Enumeration

CWE-73

CWE-294

Related Identifiers

BDU:2025-14827

CVE-2025-30201

GHSA-X697-JF34-GP5X

Affected Products

Wazuh Agent

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/30xxx/CVE-2025-30201.json · Exploit
• https://github.com/wazuh/wazuh/security/advisories/GHSA-x697-jf34-gp5x · Vendor Advisory
• https://github.com/wazuh/wazuh/commit/688972da589e5d40d2a81bcd738240303a3dc45a · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-30201 · Security Note
• https://osv.dev/vulnerability/CVE-2025-30201 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14827 · Security Note
• https://github.com/wazuh/wazuh/pull/30060 · Note
• https://twitter.com/VulmonFeeds/status/1992011208208126373 · Twitter Post
• https://t.me/CVEtracker/37963 · Telegram Post
• https://twitter.com/transilienceai/status/1995335171805978911 · Twitter Post
• https://twitter.com/Hossted_OSS/status/1995330873135153175 · Twitter Post
• https://t.me/cveNotify/144540 · Telegram Post
• https://wiz.io/vulnerability-database/cve/cve-2025-30201 · Note
• https://twitter.com/dailycve/status/1995937035182559360 · Twitter Post
• https://twitter.com/gothburz/status/1992073155494514973 · Twitter Post