CVE-2024-1243: wazuh Improper Input Validation
Vulnerability summary
CVE-2024-1243 is a critical (CVSS 9.5) Improper Input Validation vulnerability in wazuh. EPSS estimates a 0.64% chance of exploitation in the next 30 days, higher than 49.5% of scored vulnerabilities. 2 public exploits are recorded.
Timeline
- 11-06-2025PublishedVulnerability first disclosed.
- 11-06-2025Last modifiedVulnerability information updated.
Description
Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM via AD CS certificate forging and other similar attacks.
CVSS metrics
3 scores · 2 sources · 2 versions- NVDNIST9.5CriticalCVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
EPSS trend
Probability
0.64%
Chance of exploitation in the next 30 days
Percentile
50%
Versus all other CVEs
30-day change
0.00 pp
From 0.64% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
2 foundWazuh
Maturity: poc
Exploit Reference (pentraze.com)
Maturity: unknown
Weaknesses
CWE · root cause- CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.
- CWE-73External Control of File Name or PathThe product allows user input to control or influence paths or file names that are used in filesystem operations.
Affected systems
Wazuh2 products
- wazuh< 4.8.0
- wazuh agent< 4.8.0
1 vendor · 2 products
References
3 links- pentraze.comProduct