CVE-2025-64169
📋 TL;DR
This vulnerability allows a compromised Wazuh agent to crash the analysisd service on the Wazuh manager by sending a specially crafted message. It affects Wazuh deployments running versions 3.7.0 through 4.11.x where agents could be compromised.
💻 Affected Systems
- Wazuh
📦 What is this software?
Wazuh by Wazuh
⚠️ Risk & Real-World Impact
Worst Case
Denial of service causing security monitoring disruption, potentially allowing undetected attacks during the outage.
Likely Case
Intermittent analysisd crashes requiring service restarts, degrading security monitoring capabilities.
If Mitigated
Minimal impact if agents are properly secured and monitored for compromise.
🎯 Exploit Status
Requires agent compromise first, then sending crafted message to manager.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.12.0
Vendor Advisory: https://github.com/wazuh/wazuh/security/advisories/GHSA-hc35-h924-8596
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Upgrade Wazuh manager to version 4.12.0 or later. 3. Restart Wazuh services. 4. Consider upgrading agents to maintain compatibility.
🔧 Temporary Workarounds
Agent Monitoring and Isolation
allImplement strict monitoring and isolation of Wazuh agents to prevent compromise.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Wazuh agents from potential compromise vectors.
- Enhance agent security monitoring and implement immediate alerting for any agent compromise indicators.
🔍 How to Verify
Check if Vulnerable:
Check Wazuh manager version: if between 3.7.0 and 4.11.x inclusive, system is vulnerable.Check Version:
wazuh-manager -VVerify Fix Applied:
Verify Wazuh manager version is 4.12.0 or later and analysisd service is running without crashes.📡 Detection & Monitoring
Log Indicators:
- analysisd service crashes in /var/ossec/logs/ossec.log
- Unexpected termination of analysisd process
Network Indicators:
- Unusual traffic patterns from agents to manager on port 1514
SIEM Query:
source="ossec.log" AND ("analysisd" AND ("crash" OR "segmentation fault" OR "terminated"))