CVE-2025-30201
Published: 21 November 2025
Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings,…
more
potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0.
Mitigating Controls (NIST 800-53 r5)AI
Requires timely remediation of the specific flaw in Wazuh Agent prior to version 4.13.0 by applying the patch that fixes malicious UNC path handling in configuration settings.
Validates all information inputs to agent configuration settings to block injection of malicious UNC paths that trigger unwanted NTLM authentication.
Restricts access to Wazuh Agent configuration changes to authorized personnel only, mitigating exploitation by high-privilege (PR:H) authenticated attackers.
Security SummaryAI
CVE-2025-30201 is a vulnerability in the Wazuh Agent, a component of the free and open-source Wazuh platform for threat prevention, detection, and response. Affecting versions prior to 4.13.0, the flaw enables authenticated attackers to force NTLM authentication by injecting malicious UNC paths into various agent configuration settings. This issue is rated with a CVSS v3.1 base score of 7.7 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) and is associated with CWEs-73 (External Control of File Name or Path) and CWE-294 (Authentication Bypass by Capture-replay).
An attacker with high privileges (PR:H) on a network-accessible system can exploit this vulnerability by crafting agent configurations that trigger NTLM authentication attempts. This facilitates NTLM relay attacks, allowing the attacker to impersonate the Wazuh Agent when authenticating to other systems, potentially resulting in privilege escalation and remote code execution on target machines.
The vulnerability has been addressed in Wazuh version 4.13.0. Official mitigation details are available in the Wazuh security advisory (GHSA-x697-jf34-gp5x), along with the patching commit (688972da589e5d40d2a81bcd738240303a3dc45a) and pull request (30060) on the Wazuh GitHub repository. Security practitioners should upgrade to version 4.13.0 or later to remediate the issue.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability allows high-privileged authenticated attackers to inject malicious UNC paths into Wazuh Agent configurations, forcing NTLM authentication attempts that enable Forced Authentication (T1187) and facilitate NTLM relay attacks.