Microsoft · Windows · CVE-2025-27237
**Name of the Vulnerable Software and Affected Versions**
Zabbix Agent versions 6.0.0 through 6.0.40
Zabbix Agent versions 7.0.0 through 7.0.17
Zabbix Agent versions 7.2.0 through 7.2.11
Zabbix Agent versions 7.4.0 through 7.4.1
Zabbix Agent 2 versions 6.0.0 through 7.4.1
**Description**
The Zabbix Agent and Agent 2 for Windows loads the OpenSSL configuration file from a directory accessible to users with limited privileges. This allows a malicious actor to modify the OpenSSL configuration, potentially injecting a Dynamic Link Library (DLL) and escalating their privileges to a higher level, such as SYSTEM. The issue involves a flaw in the mechanism controlling the loading of the OpenSSL configuration file. Proof-of-Concept (PoC) code has been developed to demonstrate the local privilege escalation.
**Recommendations**
Update Zabbix Agent for Windows to version 6.0.41.
Update Zabbix Agent for Windows to version 7.0.18.
Update Zabbix Agent for Windows to version 7.2.12.
Update Zabbix Agent for Windows to version 7.4.2.