Detections
Analytics

SCA: security update for github.com/wazuh/wazuh (GHSA-hcrc-79hj-m3qh)

critical Tenable Cloud Security Plugin ID 434643

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in
 version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code
 execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using
 `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an
 unsanitized dictionary in DAPI request/response, they can forge an unhandled exception
 (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody
 with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations,
 even by a compromised agent. Version 4.9.1 contains a fix. (CVE-2025-24016)

See Also

https://github.com/advisories/GHSA-hcrc-79hj-m3qh

Plugin Details

Severity: Critical

ID: 434643

Version: Revision 1.9

Type: Local

Family: SCA Checks

Published: 8/19/2025

Updated: 7/2/2026

Supported Sensors: Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: High

Score: 8

Percentile: 99.68

Vendor

Vendor Severity: Critical

CVSS v2

Risk Factor: High

Base Score: 8.7

Temporal Score: 7.2

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:C/A:C

CVSS Score Source: CVE-2025-24016

CVSS v3

Risk Factor: Critical

Base Score: 9.9

Temporal Score: 9.2

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/22/2025

Vulnerability Publication Date: 2/10/2025

CISA Known Exploited Vulnerability Due Dates: 7/1/2025

Exploitable With

Metasploit (Wazuh server remote code execution caused by an unsafe deserialization vulnerability.)

Reference Information

CVE: CVE-2025-24016

cwe: CWE-502