CVE-2025-62785: 
Wazuh Agent vulnerability analysis and mitigation

CVE-2025-62785 is a NULL pointer dereference vulnerability in Wazuh's analysisd component that allows a compromised agent to crash the Wazuh manager's analysis daemon by sending a specially crafted SCA (Security Configuration Assessment) message. The flaw affects all Wazuh versions up to and including 4.10.1, and was disclosed on October 29, 2025. It carries a CVSS v3.1 base score of 7.5 (High) and a CVSS v4.0 base score of 6.9 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is classified as CWE-476 (NULL Pointer Dereference) and CWE-252 (Unchecked Return Value). In json_decoder.c, the fillData() function calls os_strdup(value, ...) at line 197 without first verifying that value is non-NULL. When a crafted SCA message is parsed by cJSON_ParseWithOpts() and the description field is encoded as a JSON number rather than a string, cJSON_GetObjectItem() returns a cJSON object whose valuestring member is NULL. This NULL is then passed through FillScanInfo() → fillData() → os_strdup(), triggering a segmentation fault in analysisd. The fix, committed in 17f8dc2, adds cJSON_IsString() type checks before accessing valuestring and adds a NULL guard for value in fillData() (GitHub Advisory, Patch Commit).

Successful exploitation causes analysisd — the core event analysis daemon of the Wazuh manager — to crash, rendering threat detection and response capabilities unavailable. The impact is limited to availability; there is no confidentiality or integrity impact, and no lateral movement or data exfiltration is possible through this vulnerability alone. However, disabling analysisd effectively blinds the Wazuh deployment, preventing detection of concurrent attacks across all monitored endpoints (GitHub Advisory).

No public exploit code beyond the PoC crash report included in the GitHub Security Advisory is known. Exploitation requires either enrolling a new agent (if open enrollment is enabled) or compromising an existing registered agent, making unauthenticated exploitation possible only when agent auto-enrollment is open. The EPSS score is approximately 0.044% (very low), and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. No threat actor attribution or in-the-wild exploitation has been reported (GitHub Advisory).

1. Reconnaissance: Identify a Wazuh manager running version ≤ 4.10.1 with agent enrollment enabled (default port 1515) or identify a compromised existing agent.
2. Enroll or compromise an agent: Either register a new agent via the Wazuh enrollment service (if open) or gain control of an existing enrolled agent to obtain valid agent credentials.
3. Craft a malicious SCA message: Construct a JSON SCA summary-type message where the description field is set to a numeric value (e.g., {"type":"summary", "description": 12345, ...}) rather than a string, causing cJSON's valuestring to be NULL.
4. Send the message to the Wazuh manager: Transmit the crafted message from the agent to the manager's analysis queue (typically via the agent communication channel on port 1514).
5. Trigger crash: The DecodeSCA → HandleScanInfo → FillScanInfo → fillData → os_strdup(NULL, ...) call chain dereferences the NULL pointer, causing analysisd to crash with a SIGSEGV, making the Wazuh manager's detection capabilities unavailable (GitHub Advisory, Patch Commit).

• Logs: Wazuh analysisd log (/var/ossec/logs/ossec.log) showing unexpected process termination or segmentation fault entries; AddressSanitizer-style SEGV reports referencing fillData in json_decoder.c:197 or FillScanInfo in security_configuration_assessment.c:1715.
• Process: Unexpected termination or restart of the analysisd process on the Wazuh manager; repeated analysisd restarts visible in process monitoring or systemd journal (journalctl -u wazuh-manager).
• Network: Unusual SCA-type messages from an agent containing numeric values in fields expected to be strings (e.g., description as an integer in a summary event); agent messages arriving from unexpected or newly enrolled agents.
• File System: Core dump files generated by analysisd in /var/ossec/ or the system's core dump directory following a crash.

Wazuh has released version 4.10.2 which fixes this vulnerability by adding NULL and type checks in fillData() and FillScanInfo(). All users running Wazuh ≤ 4.10.1 should upgrade to 4.10.2 immediately. No configuration-based workaround is available; if upgrading is not immediately possible, restricting agent enrollment to trusted agents only and monitoring for unexpected analysisd crashes can reduce risk (GitHub Advisory, Patch Commit).

The vulnerability was reported by researcher gmetaxo, who provided detailed reproduction instructions and an encrypted email disclosure to the Wazuh team as early as January 23rd (tested up to version 4.9.0), demonstrating responsible disclosure. The advisory was published by Wazuh maintainer vikman90 on October 29, 2025. No significant broader media coverage or social media discussion has been identified beyond the GitHub Security Advisory (GitHub Advisory).