Quantum Secular Labs / Blog / Advisories

CVE-2025-24016: Wazuh Server Deserialization of Untrusted Data Vulnerability

CVE-2025-24016 is rated critical with a CVSS v3.1 base score of 9.9 and affects Wazuh Wazuh Server. Per its scoring, it can be exploited over the network, without any user interaction. CISA added it to its Known Exploited Vulnerabilities catalog on 2025-06-10, which means exploitation in the wild has been observed.

Vulnerability description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.

Severity breakdown

CVSS v3.1 9.9: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

  • Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
  • Attack complexity: Low. No special conditions; the attack can be repeated reliably.
  • Privileges required: Low. A basic user account is enough.
  • User interaction: None. No action from any user is needed.
  • Scope: Changed. Impact reaches beyond the vulnerable component to other resources.
  • Confidentiality impact: Low. Some information is exposed.
  • Integrity impact: High. Total loss of integrity; data or system state can be fully modified.
  • Availability impact: High. Total loss of availability; the component can be shut down.

Underlying weakness

CWE-502: Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Affected products

  • Wazuh: from 4.4.0 before 4.9.1

References