CVE-2025-30201

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings, potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0.

CVSS v3 7.7 HIGH

7.7^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.3 / Impact : 5.8

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://github.com/wazuh/wazuh/commit/688972da589e5d40d2a81bcd738240303a3dc45a	Patch
https://github.com/wazuh/wazuh/pull/30060	Issue Tracking
https://github.com/wazuh/wazuh/security/advisories/GHSA-x697-jf34-gp5x	Exploit Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*

History

19 Oct 2026, 13:10

Type	Values Removed	Values Added
Summary		(es) Wazuh es una plataforma de código abierto y gratuita utilizada para la prevención, detección y respuesta a amenazas. Antes de la versión 4.13.0, una vulnerabilidad en el Agente de Wazuh permite a atacantes autenticados forzar la autenticación NTLM a través de rutas UNC maliciosas en varias configuraciones del agente, lo que podría conducir a ataques de retransmisión NTLM que resultarían en escalada de privilegios y ejecución remota de código. Este problema ha sido parcheado en la versión 4.13.0.

Information

Published : 2025-11-21 19:15

Updated : 2026-10-19 13:10

NVD link : CVE-2025-30201

Mitre link : CVE-2025-30201

CVE.ORG link : CVE-2025-30201

JSON object : View

Products Affected

wazuh

wazuh

CWE

CWE-73

External Control of File Name or Path

CWE-294

Authentication Bypass by Capture-replay

NVD-CWE-noinfo

{"id": "CVE-2025-30201", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-30201", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-11-22T04:55:22.553744Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.7, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.8, "exploitabilityScore": 1.3}, {"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 9.1, "attackVector": "NETWORK", "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"status": "affected", "version": "< 4.13.0"}]}]}], "published": "2025-11-21T19:15:50.293", "references": [{"url": "https://github.com/wazuh/wazuh/commit/688972da589e5d40d2a81bcd738240303a3dc45a", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wazuh/wazuh/pull/30060", "tags": ["Issue Tracking"], "source": "security-advisories@github.com"}, {"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-x697-jf34-gp5x", "tags": ["Exploit", "Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-73"}, {"lang": "en", "value": "CWE-294"}]}, {"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings, potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0."}, {"lang": "es", "value": "Wazuh es una plataforma de c\u00f3digo abierto y gratuita utilizada para la prevenci\u00f3n, detecci\u00f3n y respuesta a amenazas. Antes de la versi\u00f3n 4.13.0, una vulnerabilidad en el Agente de Wazuh permite a atacantes autenticados forzar la autenticaci\u00f3n NTLM a trav\u00e9s de rutas UNC maliciosas en varias configuraciones del agente, lo que podr\u00eda conducir a ataques de retransmisi\u00f3n NTLM que resultar\u00edan en escalada de privilegios y ejecuci\u00f3n remota de c\u00f3digo. Este problema ha sido parcheado en la versi\u00f3n 4.13.0."}], "lastModified": "2026-10-19T13:10:00.110", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6248EA61-D178-48E6-B2E3-EA37BFEDC305", "versionEndExcluding": "4.13.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}