CVE-2025-30201

CriticalCVSS 9.1/10Last modified Oct 19, 2026

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings, potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0.

Metrics

CVSS 3.1 9.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Weakness enumeration

CWE-73CWE-294

Affected software

No affected versions have been published.

Timeline

Published
Nov 21, 2025
Last modified
Oct 19, 2026
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-302027.5vLLM is a high-throughput and memory-efficient inference and serving engine for LLMs. Versions starting from 0.5.2 and prior to 0.8.5 are vuCVE-2025-302034.8Tuleap is an Open Source Suite to improve management of software developments and collaboration. Tuleap allows cross-site scripting (XSS) viCVE-2025-302047.5golang-jwt is a Go implementation of JSON Web Tokens. Starting in version 3.2.0 and prior to versions 5.2.2 and 4.5.2, the function parse.PaCVE-2025-302057.6kanidim-provision is a helper utility that uses kanidm's API to provision users, groups and oauth2 systems. Prior to version 1.2.0, a faultyCVE-2025-302069.8Dpanel is a Docker visualization panel system which provides complete Docker management functions. The Dpanel service contains a hardcoded JCVE-2025-302077.5Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby setupCVE-2025-302087.5Vite, a provider of frontend development tooling, has a vulnerability in versions prior to 6.2.3, 6.1.2, 6.0.12, 5.4.15, and 4.5.10. `@fs` dCVE-2025-302095.3Tuleap is an Open Source Suite to improve management of software developments and collaboration. An attacker can access release notes contenCVE-2025-30218.7Path Traversal vulnerability in e-solutions e-management. This vulnerability could allow an attacker to access confidential files outside thCVE-2025-302106.1Bruno is an open source IDE for exploring and testing APIs. Prior to 1.39.1, the custom tool-tip components which internally use react-tooltCVE-2025-302117.5Erlang/OTP is a set of libraries for the Erlang programming language. Prior to versions OTP-27.3.1, 26.2.5.10, and 25.3.2.19, a maliciously CVE-2025-302127.5Frappe is a full-stack web application framework. An SQL Injection vulnerability has been identified in Frappe Framework prior to versions 1