Zero Day Unit@zero_day_unit
ZDU-081 Wazuh Server: Ejecución Remota Crítica en SIEM https://qma.mx/cve-2025-24016-wazuh-server-siem-rce/ #Threatintel #Cybersecurity #ZeroDayUnit
00000120
155 followersView on X
CVE-2025-24016(wazuh / wazuh)
LOWCVSS 9.9 · CRITICALCISA KEVSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
0.0/ 10 priority
Sources & remediation
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2025-07-01. Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Exploit / PoC references
Other references
Weakness type (CWE)
CWE-502
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
NONE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- wazuh
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Affected systems
Vendors
Products
wazuh
Deep dive
Activity timeline1 mentions / 1d
Referenced assets1 URL
Full discourse1 post
CPE platform detail1 entries
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | wazuh | wazuh | - | - | - |