by Kastro
Paper/Archive/CVE-2022-43516

CVE-2022-43516

Zabbix Zabbix agent (MSI packages) — Zabbix Agent installer adds “allow all TCP any any” firewall rule

EPSS 1.0%public exploitCVSS 9.8
critical.is priorityof 100
52
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 62.7.627 × 2012.5Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)

Affected

ProductAffectedFixed inSource
Zabbix agent (MSI packages)Oct. 29, 2022 - Dec 2, 2022–CNA
Zabbix agent 2 (MSI packages)Oct. 29, 2022 - Dec 2, 2022–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Zabbix (CNA)6.5CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:L
CISA ADPSSVCExploitation: poc · Automatable: no · Technical impact: partial

References

refsupport.zabbix.com/browse/ZBX-22002