CVE-2025-24016
Wazuh Server Deserialization of Untrusted Data Vulnerability
Description
CVE-2025-24016 is a critical unsafe deserialization vulnerability in the Wazuh open-source security platform, specifically in the DistributedAPI (DAPI) component. The flaw allows an attacker with API access to achieve remote code execution on Wazuh servers by injecting a specially crafted dictionary into DAPI request/response parameters that triggers arbitrary Python code evaluation through the as_wazuh_object deserialization function. With a CVSS v3.1 base score of 9.9 (CRITICAL), the vulnerability requires only low privileges and can affect resources beyond the vulnerable component (Scope: Changed). CISA has added CVE-2025-24016 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 93.80% at the 100th percentile indicates near-certain exploitation activity, making it one of the most actively targeted security platform vulnerabilities. Wazuh versions 4.4.0 through 4.9.0 are affected, with the fix available in version 4.9.1.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| wazuh | wazuh | >= 4.4.0, < 4.9.1 |
References
- https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh(Exploit, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24016(US Government Resource)
Weakness Type
CWE-502: Deserialization of Untrusted Data
The unsafe deserialization weakness in CVE-2025-24016 allows an attacker to manipulate serialized objects to execute arbitrary code during the deserialization process. In Wazuh's DistributedAPI, parameters serialized as JSON are deserialized using the as_wazuh_object function without proper validation, enabling an attacker to forge an unhandled exception that evaluates arbitrary Python code on the server.
Learn more: CWE-502 — Deserialization of Untrusted Data
Impact Analysis
The impact of CVE-2025-24016 is extraordinary, with Integrity (High) and Availability (High) fully compromised and Confidentiality (Low) also affected. Critically, the Scope is Changed (S:C), meaning exploitation can affect resources beyond the Wazuh server itself, potentially compromising the entire monitored infrastructure. The attack is network-accessible (AV:N) with low complexity (AC:L), requires only low privileges (PR:L), and needs no user interaction (UI:N). An attacker who gains API access, whether through a compromised dashboard, cluster node, or in certain configurations even a compromised agent, can execute arbitrary Python code on the Wazuh server. The EPSS score of 93.8% at the 100th percentile confirms near-certain exploitation. Compromising a security monitoring platform is particularly devastating as it can allow attackers to disable detection capabilities, manipulate security alerts, and operate undetected within the environment.
Exploit Maturity
CVE-2025-24016 exhibits near-maximum exploit maturity with an extraordinary EPSS score of 93.80% at the 100th percentile, placing it in the top 0.2% of all vulnerabilities for exploitation probability. CISA has confirmed active exploitation in the wild. Public exploit code and a detailed security advisory are available via the Wazuh GitHub Security Advisory, which includes technical details about the deserialization mechanism. Targeting a security monitoring platform like Wazuh is a high-value objective for sophisticated threat actors, as compromising the SIEM/XDR platform can disable an organization's visibility into attacks across their entire infrastructure.
Remediation
-
Upgrade Wazuh to version 4.9.1 or later immediately. The fix addresses the unsafe deserialization vulnerability in the DistributedAPI. Follow the official Wazuh upgrade documentation for the recommended upgrade path from your current version.
-
Restrict API access to the Wazuh server by implementing strict network segmentation and authentication controls. Ensure the Wazuh API is not exposed to untrusted networks, and use TLS with certificate-based authentication for all API communications between cluster nodes and dashboards.
-
Audit Wazuh agent configurations to identify any compromised agents that could serve as an attack vector. In configurations where agents have API access, ensure agents are authenticated with unique certificates and that agent-to-server communication is encrypted and monitored.
-
Review Wazuh server logs for signs of exploitation, including unusual DAPI requests, unexpected Python process executions, modified configuration files, or new user accounts. Check for any evidence that the deserialization vulnerability was used to inject malicious code.
-
Implement defense-in-depth measures for the Wazuh deployment, including running the Wazuh server with minimal privileges, deploying file integrity monitoring on the Wazuh installation directory, and setting up out-of-band alerting for critical security platform events that would remain functional even if the primary Wazuh instance is compromised.
Technical Details
CVE-2025-24016 is an unsafe deserialization vulnerability in Wazuh's DistributedAPI (DAPI) communication layer, specifically in the as_wazuh_object function located in framework/wazuh/core/cluster/common.py. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H reflects a network-accessible (AV:N), low-complexity (AC:L) attack requiring low privileges (PR:L), no user interaction (UI:N), with Changed scope (S:C) and high impact on integrity and availability. The DAPI mechanism serializes parameters as JSON for communication between Wazuh cluster nodes and API consumers. The as_wazuh_object deserialization function processes these JSON objects without adequate validation, allowing an attacker to inject a specially crafted dictionary containing an __unhandled_exc__ key that triggers the evaluation of arbitrary Python code on the server. The attack can be launched by anyone with API access, including compromised Wazuh dashboards, other cluster nodes, or in certain deployment configurations, even compromised Wazuh agents. The Changed scope (S:C) reflects that code execution on the Wazuh server can be leveraged to compromise the entire monitored infrastructure through the platform's management capabilities. Versions 4.4.0 through 4.9.0 are affected, and the fix in 4.9.1 implements proper input validation and removes the dangerous deserialization path.
Frequently Asked Questions
Is CVE-2025-24016 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2025-24016 to the Known Exploited Vulnerabilities catalog. The EPSS score of 93.80% at the 100th percentile places it in the top 0.2% of all vulnerabilities for exploitation probability, indicating near-certain exploitation activity.
What products are affected by CVE-2025-24016?
Wazuh versions 4.4.0 through 4.9.0 are affected. This includes all Wazuh server deployments, whether standalone or clustered, that expose the API or have inter-cluster communication enabled. In certain configurations, compromised agents may also serve as an attack vector.
How do I fix CVE-2025-24016?
Upgrade Wazuh to version 4.9.1 or later, which fixes the unsafe deserialization vulnerability in the DistributedAPI. Restrict API access to trusted networks and implement certificate-based authentication for all cluster communications.
How severe is CVE-2025-24016?
CVE-2025-24016 is rated CRITICAL with a CVSS v3.1 score of 9.9 out of 10 and a Changed scope, meaning exploitation can affect resources beyond the vulnerable Wazuh server. As a security monitoring platform, a compromised Wazuh deployment can undermine an organization's entire detection and response capability.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.