Skip to content
CVE PROGRAM SOURCE RECORD7.3 High

CVE-2025-27237

DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zabbix

Description

In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zabbix Zabbix

Default version status: unknown

  • 6.0.0 to ≤ 6.0.40affected
  • 7.0.0 to ≤ 7.0.17affected
  • 7.2.0 to ≤ 7.2.11affected
  • 7.4.0 to ≤ 7.4.1affected

References