Zabbix Agent installer adds “allow all TCP any any” firewall rule
Priority HIGH 75CWE-16Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA.
Summary
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00996 62nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Zabbix agent (MSI packages) (Zabbix): Dec 3, 2022Zabbix agent 2 (MSI packages) (Zabbix): Dec 3, 2022
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Zabbix | Zabbix agent (MSI packages) | Oct. 29, 2022 - Dec 2, 2022 | Dec 3, 2022 | Patch available | CNA |
| Zabbix | Zabbix agent 2 (MSI packages) | Oct. 29, 2022 - Dec 2, 2022 | Dec 3, 2022 | Patch available | CNA |
- Zabbix agent (MSI packages) VendorZabbix Affected Oct. 29, 2022 - Dec 2, 2022 Fixed in Dec 3, 2022 Patch available CNA
- Zabbix agent 2 (MSI packages) VendorZabbix Affected Oct. 29, 2022 - Dec 2, 2022 Fixed in Dec 3, 2022 Patch available CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:windows_firewall:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | Microsoft |
| cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* | 6.0.10 to before 6.0.12; 6.2.0 to before 6.2.6 | Vulnerable | Zabbix |
| cpe:2.3:a:zabbix:zabbix:6.0.12:rc1:*:*:*:*:*:* | 6.0.12 rc1 | Vulnerable | Zabbix |
| cpe:2.3:a:zabbix:zabbix:6.2.6:rc1:*:*:*:*:*:* | 6.2.6 rc1 | Vulnerable | Zabbix |
- cpe:2.3:a:microsoft:windows_firewall:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
- cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* Versions 6.0.10 to before 6.0.12; 6.2.0 to before 6.2.6 Vulnerable ·Zabbix
- cpe:2.3:a:zabbix:zabbix:6.0.12:rc1:*:*:*:*:*:* Versions 6.0.12 rc1 Vulnerable ·Zabbix
- cpe:2.3:a:zabbix:zabbix:6.2.6:rc1:*:*:*:*:*:* Versions 6.2.6 rc1 Vulnerable ·Zabbix
Remediation
- Fix · CNA Zabbix agent (MSI packages) (Zabbix) Fixed in Dec 3, 2022
- Fix · CNA Zabbix agent 2 (MSI packages) (Zabbix) Fixed in Dec 3, 2022
Timeline
- 2026-10-02 Threatist record created from CVE-2022-43516
- 2026-10-03 Alias added: GHSA-wpfh-pv35-c3gc
References
More Zabbix vulnerabilities
- TI-2022-07300 Authentication bypass by spoofing in Zabbix Frontend KEVCVSS 3.1CRITICAL 9.8
- TI-2024-28315 SQL injection in user.get API CVSS 3.1CRITICAL 9.9
- TI-2016-08210 SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote… CVSS 3.0CRITICAL 9.8
- TI-2013-04884 Multiple SQL injection vulnerabilities in Zabbix 1.8.x before 1.8.18rc1, 2.0.x before 2.0.9rc1, and 2.1.x before 2.1.7. CVSS 3.1CRITICAL 9.8
- TI-2022-07303 Possible view of the setup pages by unauthenticated users if config file already exists KEVCVSS 3.1MEDIUM 5.3
- TI-2024-14721 Time Based SQL Injection in Zabbix Server Audit Log CVSS 3.1CRITICAL 9.1
Sources
- CVE-2022-43516 · CVE Program
- CVE-2022-43516 · NVD
- FIRST EPSS
- GHSA-wpfh-pv35-c3gc · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences