CVE-2025-30201
📋 TL;DR
This vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in agent configuration settings. This could lead to NTLM relay attacks resulting in privilege escalation and remote code execution. Organizations using Wazuh Agent versions before 4.13.0 are affected.
💻 Affected Systems
- Wazuh Agent
📦 What is this software?
Wazuh by Wazuh
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through NTLM relay leading to domain admin privileges and complete network takeover.
Likely Case
Local privilege escalation on affected systems leading to lateral movement within the network.
If Mitigated
Limited impact with proper network segmentation and NTLM relay protections in place.
🎯 Exploit Status
Requires authenticated access to agent configuration and knowledge of NTLM relay techniques.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.13.0
Vendor Advisory: https://github.com/wazuh/wazuh/security/advisories/GHSA-x697-jf34-gp5x
Restart Required: Yes
Instructions:
1. Upgrade Wazuh Agent to version 4.13.0 or later. 2. Restart the agent service. 3. Verify the agent reconnects to the Wazuh manager.
🔧 Temporary Workarounds
Restrict Agent Configuration Access
allLimit who can modify Wazuh Agent configuration files and settings.
chmod 600 /var/ossec/etc/ossec.conf
Set appropriate Windows file permissions
Disable NTLM Authentication
windowsConfigure systems to use Kerberos instead of NTLM where possible.
Group Policy: Network security: Restrict NTLM: Incoming NTLM traffic = Deny all
🧯 If You Can't Patch
- Implement strict access controls on Wazuh Agent configuration files
- Enable SMB signing and LDAP signing to prevent NTLM relay attacks
🔍 How to Verify
Check if Vulnerable:
Check Wazuh Agent version: On Linux: /var/ossec/bin/wazuh-agentd -V, On Windows: Check installed programs or service propertiesCheck Version:
Linux: /var/ossec/bin/wazuh-agentd -V | grep 'Wazuh v', Windows: wmic product where name='Wazuh Agent' get versionVerify Fix Applied:
Confirm version is 4.13.0 or higher and agent is functioning normally📡 Detection & Monitoring
Log Indicators:
- Unauthorized modifications to ossec.conf
- Unexpected UNC path references in agent logs
- Failed authentication attempts from unexpected sources
Network Indicators:
- Unexpected SMB traffic to/from Wazuh agents
- NTLM authentication attempts to unusual destinations
SIEM Query:
source="wazuh" AND (event_id=550 OR event_id=553) AND (UNC OR \\\\ in message)