Improper Input Validation in OSSEC HIDS Agent for Windows
CVE-2024-1244

9.5CRITICAL

Key Information:

Vendor

Ossec

Status
Ossec-hids Agent
Vendor
CVE Published:
11 June 2025

What is CVE-2024-1244?

The OSSEC HIDS Agent for Windows prior to version 3.8.0 is susceptible to improper input validation. An attacker capable of controlling the OSSEC server or possessing the agent's key can manipulate the agent's configuration to connect to a malicious UNC path. This vulnerability can lead to the exposure of machine account NetNTLMv2 hashes. Such compromises enable attackers to relay these hashes to perform remote code execution or escalate privileges to SYSTEM by means of Active Directory Certificate Services (AD CS) certificate forging and similar methods.

Affected Version(s)

OSSEC-HIDS Agent Windows 3.8.0

References

https://pentraze.com/
https://pentraze.com/vulnerability-reports/

CVSS V4

Score:
9.5
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Rilke Petrosky of Pentraze Cybersecurity
.