Wazuh Manager Privilege Escalation via Admin-Protection Bypass (CVE-2025-41424)

Vulnerability Overview Vulnerability Name: Privilege Escalation via Admin-Protection Bypass in update-user API Endpoint Description: The API endpoint in Wazuh Manager 4.14.4 contains a privilege escalation vulnerability. This allows any authenticated user with the built-in role to overwrite the passwords of system administrator accounts (User ID ≤ 99), including the superuser (ID 1). This enables attackers to gain complete control over the entire Wazuh deployment. Root Cause: In at line 380, is used to set . This always returns , which is stripped by , rendering the admin protection guard in ineffective dead code. Impact Scope Affected Versions: - - CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: High - User Interaction: None - Scope: Changed - Confidentiality: Low - Integrity: Low - Availability: High CVE ID: CVE-2025-41424 Weakness: CWE-863 Remediation Immediate Fix: In , replace the following code: with: Defense in Depth: In , make the guard fail-closed: POC Code Environment: Wazuh Manager: 4.14.4-1 (apt package, commit 5935ec9, stage rc2) OS: Ubuntu 24.04.4 LTS x86_64 Installation Method: Official apt repository (packages.wazuh.com/4.x/) Setup: Exploitation: Impact Who is Affected: Any Wazuh 4.14.4 deployment (possibly earlier versions) where non-administrator users hold the role or any custom role granted . What an Attacker Can Do: Fully take over the superuser account (ID 1) and/or the dashboard account (ID 2). With superuser access, an attacker can: - Read all agent keys, security events, logs, and configurations - Modify detection rules and decoders—effectively blinding the SIEM - Push configuration changes to agents - Execute active response commands on any monitored endpoint - Create, modify, and delete any users and roles—establishing persistent access - Revoke sessions for other users Vulnerability Type: Broken Access Control / Privilege Escalation (CWE-863: Improper Authorization)

Goal Reached Thanks to every supporter — we hit 100%!

Wazuh Manager Privilege Escalation via Admin-Protection Bypass (CVE-2025-41424)

More from this source