CyberRota Analysis
AI-GeneratedThe vulnerability affects Wazuh versions 1.0.0 and above, specifically in the wazuh-analysisd component, which is susceptible to a heap buffer overflow due to improper handling of rootcheck events. An unauthenticated remote attacker can exploit this flaw to crash the analysis engine, resulting in a complete halt of SIEM alert processing while the dashboard continues to display outdated information. Organizations utilizing Wazuh in Docker deployments should prioritize patching to mitigate the risk of this high-severity vulnerability.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Wazuh is a free and open source platform used for threat prevention, detection, and response. In versions 1.0.0 and above, prior to 4.14.5, a heap buffer overflow in wazuh-analysisd allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine, causing complete loss of SIEM alert processing. The attack exploits the default configuration shipped in the official wazuh/wazuh-docker deployment with default configuration. An attacker can enroll with authd without a password to obtain a valid agent ID and encryption key, connect to remoted over the Wazuh agent protocol, and inject rootcheck events containing {key: value} patterns longer than 30 bytes that trigger a sprintf overflow of a 30-byte buffer in W_JSON_ParseRootcheck, corrupting the heap and crashing wazuh-analysisd so that all alert processing silently stops while the dashboard and API keep showing stale data.
Related CVEs
Other vulnerabilities affecting the same vendor(s)