CVE-2025-54866

Wazuh is a free and open source platform used for threat prevention, detection, and response. From version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program Files (x86)\ossec-agent\authd.pass" exposes the password to all "Authenticated Users" on the local machine. This issue has been patched in version 4.13.0.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
5.5 MEDIUM
LOCAL
LOW
LOW
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
GitHub_MCNA
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 2%
VendorProductVersion
wazuhwazuh
4.3.0 ≤
𝑥
< 4.13.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://github.com/wazuh/wazuh/commit/606f19e688944ebe5d28d72eb81ac36f8fffb143
https://github.com/wazuh/wazuh/pull/31187
https://github.com/wazuh/wazuh/releases/tag/v4.13.0
https://github.com/wazuh/wazuh/security/advisories/GHSA-mvfx-ph7m-qm37