PT-2025-40514 · Zabbix+1 · Zabbix Agent 2+3

Himbeer

·

Published

2025-10-03

·

Updated

2026-03-10

·

CVE-2025-27237

CVSS v4.0

7.3

High

AV:L/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Name of the Vulnerable Software and Affected Versions Zabbix Agent versions 6.0.0 through 6.0.40 Zabbix Agent versions 7.0.0 through 7.0.17 Zabbix Agent versions 7.2.0 through 7.2.11 Zabbix Agent versions 7.4.0 through 7.4.1 Zabbix Agent 2 versions 6.0.0 through 7.4.1
Description The Zabbix Agent and Agent 2 for Windows loads the OpenSSL configuration file from a directory accessible to users with limited privileges. This allows a malicious actor to modify the OpenSSL configuration, potentially injecting a Dynamic Link Library (DLL) and escalating their privileges to a higher level, such as SYSTEM. The issue involves a flaw in the mechanism controlling the loading of the OpenSSL configuration file. Proof-of-Concept (PoC) code has been developed to demonstrate the local privilege escalation.
Recommendations Update Zabbix Agent for Windows to version 6.0.41. Update Zabbix Agent for Windows to version 7.0.18. Update Zabbix Agent for Windows to version 7.2.12. Update Zabbix Agent for Windows to version 7.4.2.

Fix

LPE

Uncontrolled Search Path Element

Weakness Enumeration

CWE-427

Related Identifiers

BDU:2025-12554
CVE-2025-27237

Affected Products

Windows
Zabbix
Zabbix Agent
Zabbix Agent 2