Skip to content
OpenAdvisories
Medium WID-SEC-2025-2207 3 CVEs

Zabbix: Mehrere Schwachstellen

Published Oct 5, 2025 · Updated Oct 5, 2025 · de-DE

Vendor: Zabbix Product: Zabbix

Summary

Ein lokaler Angreifer oder ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in Zabbix ausnutzen, um seine Privilegien zu erhöhen und vertrauliche Informationen offenzulegen.

Product

Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.

Vulnerabilities 3

  • High 7.3
    CVE-2025-27237 Public exploit

    DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration

    In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.

    Zabbix Zabbix
  • Medium 5.1
    CVE-2025-49641

    Insufficient permission check for the problem.view.refresh action

    A regular Zabbix user with no permission to the Monitoring -> Problems view is still able to call the problem.view.refresh action and therefore still retrieve a list of active problems.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu
  • Medium 4.3
    CVE-2025-27231

    LDAP 'Bind password' field value can be leaked by a Zabbix Super Admin

    The LDAP 'Bind password' value cannot be read after saving, but a Super Admin account can leak it by changing LDAP 'Host' to a rogue LDAP server. To mitigate this, the 'Bind password' value is now reset on 'Host' change.

    Zabbix Zabbix zabbix zabbix Debian Ubuntu

Revision history

  1. #1

    Initiale Fassung

References