← CVE Intelligence

CVE-2025-27237

DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration PUBLISHED

Description (CNA)

In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.

Affected (CNA)

Vendor / productVersions
Zabbix / Zabbixaffected 6.0.0 through 6.0.40; affected 7.0.0 through 7.0.17; affected 7.2.0 through 7.2.11; affected 7.4.0 through 7.4.1

CWE

CWE-427

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.