CVE-2025-30201

Wazuh NetNTLMv2 Hash Theft In Multiple Centralized Configuration Capabilities

Published: Nov 21, 2025Updated: Dec 2, 2025 Sources: CVE List NVD BDUCWE-73

7.7HIGH

Description

Wazuh is a free and open source platform used for threat prevention, detection, and response. Prior to version 4.13.0, a vulnerability in Wazuh Agent allows authenticated attackers to force NTLM authentication through malicious UNC paths in various agent configuration settings, potentially leading NTLM relay attacks that would result privilege escalation and remote code execution. This issue has been patched in version 4.13.0.

No summary for this CVE yet.

CVSS Vector Breakdown

Exploitability

AV:NAttack Vector

Network

AC:HAttack Complexity

High

PR:HPrivileges Required

High

UI:NUser Interaction

None

Scope

S:CScope

Changed

Impact

C:HConfidentiality

High

I:HIntegrity

High

A:NAvailability

None

Open in CVSS calculator →

Weaknesses

CWE-73 CWE-294 NVD-CWE-noinfo

Affected Products

wazuh

oss-projectaka wazuh agent, wazuh-manager

wazuhMixed

Security Products / siem-soar

Wazuh, Inc

commercial·SEaka wazuh

WazuhOn-premSecurity Product

Security Products / vuln-mgmt-scanner

Exploitability

Official Patch Available

Is your org exposed to CVE-2025-30201?Request an assessment to establish which checks are appropriate for your systems. Check my exposure

Attack Graph

Products CVE Techniques Tactics

Click technique nodes for MITRE ATT&CK details · drag to pan · Ctrl/⌘ + scroll to zoom, or go fullscreen.

MITRE ATT&CK

1 technique

Defense Evasion

View detailed technique mapping

References

https://github.com/wazuh/wazuh/security/advisories/GHSA-x697-jf34-gp5x

github.com

https://github.com/wazuh/wazuh/pull/30060

github.com

https://github.com/wazuh/wazuh/commit/688972da589e5d40d2a81bcd738240303a3dc45a

github.com

and 4 more references View all →

Unlock Complete Vulnerability Intelligence

Get the full picture for CVE-2025-30201 and every CVE in our database. Create a free account — no credit card required.

Create Free Account

Plain-language analysis

Impact assessment and exploitation scenario in plain English

Attack graph visualization

Interactive attack path and kill chain mapping

Exploit details & PoC links

ExploitDB, Metasploit, GitHub PoCs with direct links

Nuclei scanner templates

Ready-to-use vulnerability scanner templates

Full remediation guide

Patch instructions, workarounds, and compliance impact

Interactive AI chat

Ask questions about this vulnerability in natural language

Related vulnerabilities

Semantically similar CVEs and attack patterns

REST API & MCP access

Integrate vulnerability data into your workflows