Critical Wazuh Server vulnerability exploited by Mirai Botnet
Take action: If you're running Wazuh server versions 4.4.0 through 4.9.0, first make sure to estrict API access to only essential authorized users. Then plan a quick update to version 4.9.1 or later. Exposed Wazuh instances will quickly become part of a botnet.
Learn More
A critical vulneability in Wazuh server is reported to be actively exploited by threat actors to deploy Mirai botnet variants for conducting distributed denial-of-service (DDoS) attacks.
Wazuh is a widely used free and open-source security information and event management (SIEM) platform used for threat prevention, detection, and response.
The vulnerability is tracked as CVE-2025-24016 (CVSS score 9.9) - an unsafe deserialization flaw that allows for remote code execution on Wazuh servers. The flaw can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent.
Security researchers at Akamai discovered exploitation attempts in late March 2025 and in May 2025. Two different Mirai botnet variants are actively targeting this vulnerability merely weeks after its public disclosure and proof-of-concept release:
- The first botnet deploys LZRD Mirai variants upon successful exploitation. The attack involves executing a shell script that downloads the Mirai botnet payload from an external server (176.65.134.62) for different architectures. The botnet has been observed exploiting various other security flaws including vulnerabilities in Hadoop YARN, TP-Link Archer AX21 (CVE-2023-1389), and a remote code execution bug in ZTE ZXV10 H108L routers.
- The second botnet identified in the attacks employs a similar strategy, using malicious shell scripts to deliver another Mirai botnet variant referred to as Resbot (also known as Resentual). Researchers noted interesting linguistic elements in this botnet's infrastructure, with associated domains using Italian nomenclature, potentially indicating campaigns targeting devices owned by Italian-speaking users. Besides attempting to spread via FTP over port 21 and conducting telnet scanning, this botnet exploits Huawei HG532 routers (CVE-2017-17215), Realtek SDK (CVE-2014-8361), and TrueOnline ZyXEL P660HN-T v1 routers (CVE-2017-18368).
Affected versions of Wazuh include:
- All versions from 4.4.0 up to but not including 4.9.1
Patched versions:
- Wazuh version 4.9.1 and later versions
Organizations should immediately upgrade to Wazuh version 4.9.1 or later and restric API access to only authorized users and systems.
