CVE-2025-30201

Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities

State: Published
Severity: 7.7 High
Published: Nov 21, 2025
Updated: Feb 26, 2026
Reserved: Mar 18, 2025

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings, potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0.

Scores

CVSS	Score	Vector	Source
3.1	7.7 High	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N	GitHub_M

Weaknesses

CWE-73 External Control of File Name or Path
CWE-294 Authentication Bypass by Capture-replay

Affected Products

Product	Versions
wazuhwazuh	< 4.13.0Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.