Wazuh - RCE (CVE-2025-24016)
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using as_wazuh_object (in framework/wazuh/core/cluster/common.py). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (__unhandled_exc__) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
psychologyCrowdSec Analysis
CVE-2025-24016 is a critical vulnerability in Wazuh that allows for remote code execution on Wazuh servers through unsafe deserialization of certain API requests. This vulnerability arises when DistributedAPI parameters are processed in a way that can enable attackers to inject and execute arbitrary code.
CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.
CrowdSec has not observed any significant exploitation activity targeting CVE-2025-24016 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
Observed exploitation attempts focus on URLs containing /security/user/authenticate/run_as.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2025-02-10 |
| Rule Released | 2025-04-07 |
| CrowdSec First Seen | 2025-05-05 |
| CISA KEV | 2025-06-10 |
| CISA Remediation Deadline | 2025-07-01 |