Wazuh - RCE (CVE-2025-24016)
1Exploiting IPs reported
Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.
CrowdSec analysis
CVE-2025-24016 is a critical vulnerability in Wazuh that allows for remote code execution on Wazuh servers through unsafe deserialization of certain API requests. This vulnerability arises when DistributedAPI parameters are processed in a way that can enable attackers to inject and execute arbitrary code.
CrowdSec has been tracking this vulnerability and its exploits since 7th of April 2025.
Based on data from the CrowdSec network, nearly all observed exploitation of CVE-2025-24016 is fully opportunistic, with attackers indiscriminately scanning the entire internet. These attacks are automated and lack any form of target selection or reconnaissance. Telemetry from the CrowdSec network also shows that exploitation activity for CVE-2025-24016 remains steady week-over-week. Attack volumes are consistent with long-term trends, indicating sustained interest from threat actors. CVE-2025-24016 continues to be an active part of the threat landscape and will likely remain this way for the forseeable future.
Observed exploitation attempts focus on URLs containing /security/user/authenticate/run_as.
Exploitation
Get real-time information about exploitation attempts and actors involved.
Common Weakness Enumeration (CWE)
Protection
Find out relevant information to protect your stack against this CVE.
Blocklist
With our advanced worldwide network detection, CrowdSec can provide a list of IPs known for exploiting the vulnerability.
To increase your protection against this CVE, block exploitation attempts with this list of identified actors.