# CVE-2025-24016: Wazuh - RCE

> Live exploitation tracking for CVE-2025-24016 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2025-24016

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.9
- **Public exploit available:** Yes
- **Affected products:** Wazuh
- **Weaknesses:** CWE-502 (Deserialization of Untrusted Data)

## Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.

## CrowdSec analysis

[CVE-2025-24016](https://euvd.enisa.europa.eu/vulnerability/CVE-2025-24016) is a critical vulnerability in Wazuh that allows for remote code execution on Wazuh servers through unsafe deserialization of certain API requests. This vulnerability arises when DistributedAPI parameters are processed in a way that can enable attackers to inject and execute arbitrary code.

CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.

CrowdSec has not observed any significant exploitation activity targeting CVE-2025-24016 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

Observed exploitation attempts focus on URLs containing `/security/user/authenticate/run_as`.

## Timeline

- 2025-02-10: CVE Published. CVE-2025-24016 is published to NVD.
- 2025-04-07: Rule Released. CrowdSec releases a rule to detect CVE-2025-24016 exploitation attempts against the CrowdSec Network.
- 2025-05-05: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2025-24016 for the first time.
- 2025-06-10: CISA KEV. CVE-2025-24016 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2025-07-01: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).

## References

- https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh
- https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2025/CVE-2025-24016.yaml

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2025-24016) follows observed exploitation activity for CVE-2025-24016. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.