{
  "_links": {
    "capec": {
      "href": "/api/v1/vulnerability/cve-2025-24016/capec"
    },
    "cvss": {
      "href": "/api/v1/vulnerability/cve-2025-24016/cvss"
    },
    "cwe": {
      "href": "/api/v1/vulnerability/cve-2025-24016/cwe"
    },
    "enrichment": {
      "href": "/api/v1/vulnerability/cve-2025-24016/enrichment"
    },
    "gcve": {
      "href": "/api/v1/vulnerability/cve-2025-24016/gcve"
    },
    "self": {
      "href": "/api/v1/vulnerability/cve-2025-24016"
    },
    "sightings": {
      "href": "/api/v1/sightings/cve-2025-24016"
    }
  },
  "enrichments": {
    "cisa-kev": {
      "kev": true
    },
    "epss": {
      "epss": 0.9384,
      "kev": true,
      "percentile": 0.99841
    },
    "nuclei": {
      "nuclei": true,
      "nuclei_template": "http/cves/2025/CVE-2025-24016.yaml",
      "nuclei_template_severity": "critical",
      "nuclei_template_yaml": "id: CVE-2025-24016\n\ninfo:\n  name: Wazuh - Unsafe Deserialization Remote Code Execution\n  author: Hüseyin TINTAŞ,ritikchaddha\n  severity: critical\n  description: |\n    A critical Remote Code Execution (RCE) vulnerability exists in Wazuh server versions >= 4.4.0 and < 4.9.1. The vulnerability occurs due to unsafe deserialization in the wazuh-manager package, specifically in the DistributedAPI where parameters are serialized as JSON and deserialized using as_wazuh_object in the framework/wazuh/core/cluster/common.py file. An attacker with API access can exploit this vulnerability by injecting an unsanitized dictionary into DAPI requests, leading to arbitrary Python code execution.\n  impact: |\n    Successful exploitation allows attackers to execute arbitrary code on the Wazuh server with the privileges of the wazuh-manager process. This can lead to complete system compromise, data exfiltration, lateral movement within the network, and potential denial of service conditions.\n  remediation: |\n    Upgrade to Wazuh version >= 4.9.1 where this vulnerability has been patched. If immediate upgrade is not possible: Restrict API access to trusted IP addresses only, implement network segmentation to isolate Wazuh servers, monitor for suspicious API requests to the /security/user/authenticate/run_as endpoint, and consider implementing a Web Application Firewall (WAF) to filter malicious requests.\n  reference:\n    - https://github.com/MuhammadWaseem29/CVE-2025-24016\n    - https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh\n    - https://nvd.nist.gov/vuln/detail/CVE-2025-24016\n  classification:\n    epss-score: 0.9384\n    epss-percentile: 0.99841\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H\n    cvss-score: 9.9\n    cve-id: CVE-2025-24016\n    cwe-id: CWE-502\n    cpe: cpe:2.3:a:wazuh:wazuh:*:*:*:*:*:*:*:*\n  metadata:\n    max-request: 2\n    vendor: wazuh\n    product: wazuh\n    shodan-query: title:\"Wazuh\"\n    fofa-query: app=\"Wazuh\"\n  tags: cve,cve2025,wazuh,deserialization,rce,authenticated,kev,vkev,vuln\n\nflow: http(1) && http(2)\n\nvariables:\n  payload: '{\"__unhandled_exc__\":{\"__class__\": \"NotARealClass\", \"__args__\": []}}'\n\nhttp:\n  - raw:\n      - |\n        GET / HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"NameError\"\n        negative: true\n        internal: true\n\n  - raw:\n      - |\n        POST /security/user/authenticate/run_as HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: application/json\n        Authorization: Basic {{base64(username + ':' + password)}}\n\n        {{payload}}\n\n    matchers-condition: and\n    matchers:\n      - type: word\n        part: body\n        words:\n          - \"NameError\"\n\n      - type: status\n        status:\n          - 500\n# digest: 490a0046304402206b0e99f02fbc10bc0e8334bd0ecac004bb2e1dbcd5515143c0719ec4732aeedc02203105572e6bb7d081293d998ab854bcc64997204cffaf5e721d354f4dccdd5bd7:922c64590222798bb761d5b6d8e72950"
    }
  },
  "vuln_id": "cve-2025-24016"
}