CVE-2025-62789: Wazuh vulnerable to NULL pointer dereference in fim_alert line 712
Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to 4.11.0, fimalert() implementation does not check whether the return value of ctimer is NULL or not before calling strdup() on it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.11.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
wazuhto a version that resolves this vulnerability.Fixed in 4.11.0
Event History
Frequently Asked Questions
What is the severity of CVE-2025-62789?
CVE-2025-62789 is classified as a medium severity vulnerability due to its potential to crash the analysis module in Wazuh.
How do I fix CVE-2025-62789?
To address CVE-2025-62789, upgrade to Wazuh version 4.11.0 or later, where the issue has been resolved.
What impact does CVE-2025-62789 have on Wazuh?
CVE-2025-62789 can lead to crashes in the Wazuh analysis module if exploited by a compromised agent.
Who is affected by CVE-2025-62789?
CVE-2025-62789 affects all versions of Wazuh prior to 4.11.0.
What components of Wazuh does CVE-2025-62789 affect?
CVE-2025-62789 specifically affects the fim_alert() implementation within Wazuh.