CVE-2025-27237
CVE-2025-27237 · DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.
CVSS 7.3 · High · EPSS 0.3% · Fix available
- Published
- Updated
Stack: applications
Affected products and versions
zabbix
- Versions
- ≥ 6.0.0, ≤ 6.0.40: Affected; ≥ 6.0.41: Not affected (git)
- ≥ 7.0.0, ≤ 7.0.17: Affected; ≥ 7.0.18: Not affected (git)
- ≥ 7.2.0, ≤ 7.2.11: Affected; ≥ 7.2.12: Not affected (git)
- ≥ 7.4.0, ≤ 7.4.1: Affected; ≥ 7.4.2: Not affected (git)
Update to 6.0.41; Update to 7.0.18; Update to 7.2.12; Update to 7.4.2