CVE-2025-54866: Wazuh installation fails to protected authd.pass on Windows
Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program Files (x86)\ossec-agent\authd.pass" exposes the password to all "Authenticated Users" on the local machine. This issue has been patched in version 4.13.0.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2025-54866?
CVE-2025-54866 is categorized as a high severity vulnerability due to the exposure of sensitive information.
How do I fix CVE-2025-54866?
To fix CVE-2025-54866, ensure that access control lists (ACLs) are correctly configured for the 'authd.pass' file.
Who is affected by CVE-2025-54866?
CVE-2025-54866 affects Wazuh versions from 4.3.0 to before 4.13.0 installed on Windows systems.
What happens if CVE-2025-54866 is exploited?
If exploited, CVE-2025-54866 allows any authenticated user on the local machine to access sensitive authentication information.
When was CVE-2025-54866 disclosed?
CVE-2025-54866 was disclosed when vulnerabilities related to file permissions were identified in the Wazuh platform.