CVE-2025-27237

HIGH

DLL injection in Zabbix Agent and Agent 2 via OpenSSL configuration

Title source: CVE List
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2025-27237 has a selected CVSS score of 7.3 (high); EIP currently links 1 repository PoC.

Description

In Zabbix Agent and Agent 2 on Windows, the OpenSSL configuration file is loaded from a path writable by low-privileged users, allowing malicious modification and potential local privilege escalation by injecting a DLL.

Description source: CVE List

Exploitation context

Available material

Repository PoCs
1

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Oct 4, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Zabbix

Browse Zabbix / Zabbix

Default status: unknown

CVE List6.0.0 to ≤ 6.0.40affected
7.0.0 to ≤ 7.0.17affected
7.2.0 to ≤ 7.2.11affected
7.4.0 to ≤ 7.4.1affected

Proofs of concept

1

Repository PoCs

GitHubHackingLZ/CVE-2025-27237Repository PoCby HackingLZ20Exploit8 files

26.9 KiB

GitHub
PoC details
Analysisdeepseek-v4-pro:cloud ·

Technical assessment

The artifact provides a complete proof-of-concept exploit for CVE-2025-27237, a local privilege escalation in Zabbix Agent for Windows via OpenSSL config hijacking. It includes step-by-step instructions to create a malicious openssl.cnf and a DLL payload (poc.c) that writes a proof file and shows a MessageBox, achieving arbitrary code execution as SYSTEM.

Backdoor review

No backdoor observed in reviewed code

The supplied text files describe a legitimate proof-of-concept for CVE-2025-27237, a local privilege escalation in Zabbix Agent for Windows. The PoC demonstrates loading a user-supplied DLL via a malicious OpenSSL configuration file. The DLL source code (poc.c) performs only benign proof-of-execution actions: writing a timestamped file to C:\EXPLOITED.txt and optionally displaying a MessageBox. No concealed, deceptive, or operator-directed harmful behavior (such as credential theft, persistence, or unrelated remote access) is present in the reviewed evidence.

ClassificationExploit
Model confidence95%
AuthenticationRequired
LanguagesMarkdownCPowerShellBatch
Target softwareZabbix AgentZabbix Agent 2OpenSSL
Attack typesLocal Privilege EscalationDLL Side-LoadingSearch Order Hijacking
Evidence & reasoningClassification basis · observed behavior · safety review
Technical evidence

Classification basis and observed behavior

Classification basis

The primary artifact is a PoC that provides complete exploit code (poc.c) and step-by-step instructions to achieve arbitrary code execution as SYSTEM. The DLL payload performs observable malicious actions (file write, MessageBox), which is characteristic of an exploit, not merely a scanner or writeup.

CVE-2025-27237-PoC.md:1-5CVE-2025-27237-PoC.md:58-93CVE-2025-27237-PoC.md:108-114

Requirements

  • Local user access to Windows system with Zabbix Agent installedCVE-2025-27237-PoC.md:24
  • Zabbix Agent configured with TLS (TLSConnect=cert or TLSAccept=cert)CVE-2025-27237-PoC.md:25
  • Ability to create directories at C:\ root (default Windows permissions allow this)CVE-2025-27237-PoC.md:26

Observed behavior

  • Creates directory structure C:\vcpkg\downloads\tools\msys2\2db36fb050d01f45\etc\sslCVE-2025-27237-PoC.md:32-34
  • Creates malicious openssl.cnf that loads a DLL via OpenSSL provider directiveCVE-2025-27237-PoC.md:40-52
  • Compiles a malicious DLL (poc.c) that writes C:\EXPLOITED.txt and shows a MessageBox on DLL_PROCESS_ATTACHCVE-2025-27237-PoC.md:58-93
  • Deploys poc.dll to the vulnerable path and triggers execution by restarting Zabbix Agent serviceCVE-2025-27237-PoC.md:101-114
  • Verifies exploitation by checking for C:\EXPLOITED.txt proof fileCVE-2025-27237-PoC.md:116-128
Safety-review evidence

Behaviors behind the backdoor verdict

Observables

File Write
C:\EXPLOITED.txtThe PoC DLL writes a proof-of-exploitation file to C:\EXPLOITED.txt, which is a benign indicator of successful code execution.CVE-2025-27237-PoC.md:64-77
Message Box
MessageBoxA with text 'CVE-2025-27237\nCode Execution via OpenSSL Config!'The PoC DLL optionally displays a MessageBox, which is a benign, visible proof of execution.CVE-2025-27237-PoC.md:80-84
Dll Export
OSSL_provider_initThe DLL exports OSSL_provider_init, which is required for OpenSSL provider loading and is consistent with the documented exploitation technique.CVE-2025-27237-PoC.md:90-92
Review boundaries

What the analysis did not establish

  • The evidence packet does not include the actual compiled DLL or the extract_openssl_paths.py script; only source code and documentation are provided.
  • The analysis_scope reports 5 unclassified files (likely the .c and .py files) that are not included in the selected text, so the full source of poc2.c, poc3.c, and extract_openssl_paths.py is not available for review.
  • Five files in the repository were not included as text in the evidence packet and were not reviewed. The inventory lists poc.c, poc2.c, poc3.c, and extract_openssl_paths.py as present but their content was not supplied. The analysis scope notes binary files were flagged as metadata-only and not analyzed.
Model interpretation

This review is limited to the supplied PoC code and context. It does not assert that the code works or is safe to execute.

References

2