Improper Input Validation in Wazuh Agent for Windows by Wazuh
CVE-2024-1243

9.5CRITICAL

Key Information:

Vendor

Wazuh

Status
Wazuh Agent
Vendor
CVE Published:
11 June 2025

What is CVE-2024-1243?

The Wazuh Agent for Windows experienced a flaw in input validation that enables attackers to manipulate agent configurations through controlled server connections. When configured to connect to a malicious UNC path, the agent can inadvertently leak sensitive machine account NetNTLMv2 hashes. These hashes may be exploited for remote code execution or to escalate privileges, particularly through Active Directory Certificate Services (AD CS) certificate forging and similar attack vectors.

Affected Version(s)

Wazuh Agent Windows < 4.8.0

References

https://pentraze.com/
https://pentraze.com/vulnerability-reports/CVE-2024-1243/
https://github.com/wazuh/wazuh/security/advisories/GHSA-3...

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rilke Petrosky of Pentraze Cybersecurity
.
CVE-2024-1243 : Improper Input Validation in Wazuh Agent for Windows by Wazuh