CVE-2025-30201 is a high severity (CVSS 7.7) flaw in the Wazuh Agent. An authenticated attacker can use malicious UNC paths in agent configuration to force NTLM authentication, which can lead to relay attacks. The record says 4.13.0 fixes it, though the advisory page lists a later release, so use the newest one.
What's affected
The record says Wazuh versions before 4.13.0 are affected, specifically the Wazuh Agent, and that 4.13.0 contains the patch.
The GitHub advisory page lists the patched version as 4.14.3 or later, which differs from the record. Use the newest agent release your environment supports and check the advisory when you plan the update.
The advisory says the impact is on agents running on Windows systems. It notes the risk is higher when the agent runs on domain controllers or other privileged systems. The record does not flag the CVE as known exploited.
How to check if you're exposed
Find the agent version on each Windows endpoint.
- In the Wazuh dashboard, open the agents list and sort or filter by version. Anything below 4.13.0 is in scope.
- On a Windows host, you can also read the version from the installed programs list.
- Review who can edit agent group configuration on the Wazuh manager, since the advisory says the attacker needs control of a Wazuh server or an agent's private key.
Also check your network for outbound SMB traffic from agents to hosts that are not file servers you expect.
What to do now
- List all Wazuh agents on Windows and note their versions.
- Upgrade agents to the latest release, and at least to a version the advisory lists as fixed.
- Restrict access to the Wazuh manager and to agent keys, and review who can change centralized agent configuration.
- Block outbound SMB (port 445) from endpoints to the internet and to hosts that do not need it.
- Consider enabling SMB signing and other NTLM relay protections in your Windows domain.
Why it matters
The record maps the flaw to CWE-294 (Authentication Bypass by Capture-replay) and CWE-73 (External Control of File Name or Path). The agent accepts file paths in several configuration areas, including security configuration assessment, osquery and file integrity monitoring, without blocking network paths. A Windows UNC path makes the machine connect to a remote file share and try to authenticate with its domain account.
If the share belongs to an attacker, they can capture the authentication material and relay it to other services. The advisory says that makes lateral movement and privilege escalation possible. The CVSS vector marks high privileges and high complexity, which narrows who can do this, but a compromised manager changes the picture quickly.
Monitoring agents are often installed on the most sensitive machines. That makes their configuration channel part of the security boundary.
Quick check
Why does the record say 4.13.0 but the advisory page says 4.14.3?
The two sources differ. Treat 4.13.0 as the minimum in the record and prefer the newest release.
Does an attacker need access first?
Yes. The advisory says control of a Wazuh server or possession of an agent's private key is required.
Sources
Last reviewed: 19 October 2026.
