CVE-2025-30201: Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings, potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2025-30201?
CVE-2025-30201 is considered a high-severity vulnerability due to the potential for authenticated attackers to exploit it.
How do I fix CVE-2025-30201?
To mitigate CVE-2025-30201, upgrade the Wazuh Agent to version 4.13.0 or later.
What type of vulnerability is CVE-2025-30201?
CVE-2025-30201 is a security vulnerability that allows NTLM authentication to be forced through malicious UNC paths.
Who is affected by CVE-2025-30201?
CVE-2025-30201 affects all versions of Wazuh Agent prior to 4.13.0.
Can CVE-2025-30201 be exploited remotely?
CVE-2025-30201 requires authenticated access, meaning an attacker must first gain access to the system to exploit it.