Raw vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:NSummary
CVE-2025-30201 is a high-severity External Control of File Name or Path (CWE-73) vulnerability in Wazuh Wazuh. Its CVSS base score is 7.7 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Data from Local System (T1005); ranked in the top 47% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified map to SC-23 (Session Authenticity) and SC-8 (Transmission Confidentiality and Integrity) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-30201 is a vulnerability in the Wazuh Agent, a component of the free and open-source Wazuh platform for threat prevention, detection, and response. Affecting versions prior to 4.13.0, the flaw enables authenticated attackers to force NTLM authentication by injecting malicious UNC paths into various agent configuration settings. This issue is rated with a CVSS v3.1 base score of 7.7 (AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:N) and is associated with CWEs-73 (External Control of File Name or Path) and CWE-294 (Authentication Bypass by Capture-replay).
An attacker with high privileges (PR:H) on a network-accessible system can exploit this vulnerability by crafting agent configurations that trigger NTLM authentication attempts. This facilitates NTLM relay attacks, allowing the attacker to impersonate the Wazuh Agent when authenticating to other systems, potentially resulting in privilege escalation and remote code execution on target machines.
The vulnerability has been addressed in Wazuh version 4.13.0. Official mitigation details are available in the Wazuh security advisory (GHSA-x697-jf34-gp5x), along with the patching commit (688972da589e5d40d2a81bcd738240303a3dc45a) and pull request (30060) on the Wazuh GitHub repository. Security practitioners should upgrade to version 4.13.0 or later to remediate the issue.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-198509
Vulnerability Data
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings,…
more
potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V10.4.16V10.5.1V5.3.2
Mitigating Controls (NIST 800-53 r5) AI
Session authenticity mechanisms directly stop replay of captured authentication traffic by enforcing freshness or cryptographic binding.
Transmission integrity (with anti-replay) stops captured messages from being accepted as valid later.
Input validation directly rejects or sanitizes untrusted path strings before they reach filesystem operations.
Enforces authorization checks on the actual resource accessed, blocking unauthorized files even when a malicious path is supplied.
Least-privilege limits the set of files or directories any subject can affect, shrinking the blast radius of a path-control flaw.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices include input validation and path sanitization that eliminate this weakness.
Protecting and verifying identity assertions prevents replay of captured authentication material.
Least-privilege file authorization directly limits damage from externally controlled paths.
Encryption and integrity protections for data-in-transit directly block capture-replay of credentials or tokens.
Network monitoring may detect anomalous replays after the fact but does not prevent the design flaw.
Strong authentication methods can reduce replay risk but do not inherently address captured messages.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Cryptographic protections (e.g., nonces, timestamps, message authentication codes) make captured authentication messages unusable for replay.
Security testing can detect path-traversal issues but does not itself implement preventive controls.
Secure authentication mechanisms directly prevent replay attacks by requiring fresh, non-replayable credentials or tokens.
Network security controls such as encryption and integrity protection reduce the feasibility of capturing and replaying authentication traffic.
Secure development lifecycle mandates input validation and path-handling controls that directly prevent external file/path manipulation.
Application security requirements explicitly call for controls against untrusted input influencing file operations.