Wazuh - RCE (CVE-2025-24016)
2Exploiting IPs reported
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
CrowdSec analysis
CVE-2025-24016 is a critical vulnerability in Wazuh that allows for remote code execution on Wazuh servers through unsafe deserialization of certain API requests. This vulnerability arises when DistributedAPI parameters are processed in a way that can enable attackers to inject and execute arbitrary code.
CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.
Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2025-24016 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. In addition, according to the CrowdSec network, attack volume against CVE-2025-24016 has dipped slightly compared to the previous week. Although still commonly targeted, the decline suggests a cooling-off period. Long-term relevance remains, but attention is waning.
Observed exploitation attempts focus on URLs containing /security/user/authenticate/run_as.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Common Weakness Enumeration (CWE)
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.