CVE-2025-54866
📋 TL;DR
This vulnerability exposes the Wazuh agent authentication password file to all authenticated users on Windows systems, allowing local attackers to read the password. It affects Wazuh installations on Windows from version 4.3.0 to 4.12.x. The password could be used to compromise the Wazuh agent or potentially escalate privileges.
💻 Affected Systems
- Wazuh Agent
📦 What is this software?
Wazuh by Wazuh
⚠️ Risk & Real-World Impact
Worst Case
An authenticated local attacker reads the authd.pass file, obtains the agent password, and uses it to compromise the Wazuh agent, potentially gaining administrative access to the system or pivoting to other systems in the Wazuh infrastructure.
Likely Case
Local authenticated users (including non-administrative accounts) can read the agent password, potentially allowing them to tamper with agent configuration or disrupt monitoring capabilities.
If Mitigated
With proper access controls and monitoring, the exposure is limited to authorized users who already have some level of system access, reducing the attack surface.
🎯 Exploit Status
Exploitation requires local authenticated access to the Windows system. The attack is simple - just reading a file with incorrect permissions.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.13.0
Vendor Advisory: https://github.com/wazuh/wazuh/security/advisories/GHSA-mvfx-ph7m-qm37
Restart Required: Yes
Instructions:
1. Download Wazuh agent version 4.13.0 or later from the official repository. 2. Stop the Wazuh agent service. 3. Install the new version. 4. Restart the Wazuh agent service.
🔧 Temporary Workarounds
Restrict file permissions manually
windowsManually set proper ACLs on the authd.pass file to restrict access to SYSTEM and Administrators only.
icacls "C:\Program Files (x86)\ossec-agent\authd.pass" /inheritance:r
icacls "C:\Program Files (x86)\ossec-agent\authd.pass" /grant SYSTEM:F
icacls "C:\Program Files (x86)\ossec-agent\authd.pass" /grant Administrators:F
🧯 If You Can't Patch
- Manually apply the file permission workaround using icacls commands
- Monitor access to the authd.pass file using Windows audit logging and alert on any non-SYSTEM/Administrator access
🔍 How to Verify
Check if Vulnerable:
Check the permissions on C:\Program Files (x86)\ossec-agent\authd.pass using 'icacls "C:\Program Files (x86)\ossec-agent\authd.pass"' and verify if 'Authenticated Users' have any permissions.Check Version:
wazuh-agentd -vVerify Fix Applied:
After patching to 4.13.0+, verify the file permissions only show SYSTEM and Administrators with full control, and no 'Authenticated Users' entries.📡 Detection & Monitoring
Log Indicators:
- Windows Security event logs showing access to authd.pass by non-SYSTEM/Administrator accounts
- Failed authentication attempts to Wazuh manager using potentially compromised credentials
Network Indicators:
- Unusual agent communication patterns or configuration changes
SIEM Query:
EventID=4663 AND ObjectName LIKE '%authd.pass%' AND SubjectUserName NOT IN ('SYSTEM', 'Administrator')