CVE-2024-1244 Remote code execution and local privilege escalation due to UNC access and NetNTLMv2 hash theft
Attackers can force the OSSEC Windows agent to access malicious UNC paths, stealing NetNTLMv2 hashes for remote code execution and privilege escalation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2024-1244?
CVE-2024-1244 is a critical path traversal vulnerability in OSSEC-HIDS Agent, published on 11 Jun 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Improper input validation in the OSSEC HIDS agent for Windows prior to version 3.8.0 allows an attacker in with control over the OSSEC server or in possession of the agent's key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM via AD CS certificate forging and other similar attacks.
Which versions are affected by CVE-2024-1244?
How do I fix CVE-2024-1244?
No fix has been published for CVE-2024-1244 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2024-1244 being exploited?
There is no known exploitation of CVE-2024-1244 in the wild and no public exploit code.
Sources
Also known as GHSA-4979-ffcq-3f48.