EUVD-2025-199985Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Zabbix frontend session (Guest or user)
-
DeliveryCraft abusive /imgstore.php parameters
-
ExploitTrigger asymmetric CPU consumption
-
ExecutionRepeat to exhaust web server CPU
-
ImpactDeny frontend availability
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2021 - Vulnerable and Outdated Components
ASVS 5.0
V2 - Validation and Business Logic Asymmetric resource consumption control
|
| Exploitation Conditions | Requires an authenticated Zabbix frontend session against the /imgstore.php endpoint; the description explicitly includes the Guest account, so where the default Guest access is left enabled the practical barrier is near-zero, but disabling Guest and requiring real authentication meaningfully limits exposure. The attack needs specially crafted request parameters and typically sustained/repeated requests to exhaust CPU; impact is limited to availability of the web frontend, with no confidentiality or integrity effect. Affected: Zabbix frontend versions 6.0.0-6.0.41, 7.0.0-7.0.18, 7.2.0-7.2.12, and 7.4.0-7.4.2. |
| Impact | This is a genuine but low-priority denial-of-service issue, not a high-severity emergency. The vendor CVSS 4.0 vector (VA:H, VC:N/VI:N) correctly scopes impact to availability only - no confidentiality or integrity exposure. EPSS is very low (0.05%, 16th percentile), there is no CISA KEV listing, and no public exploit code was identified, so exploitation is neither observed nor probable in the near term. Two signals conflict and should be flagged: the description explicitly requires 'an authenticated Zabbix user (including Guest),' yet the CVSS 4.0 vector sets PR:N (no privileges) - the PR:N is defensible only because Guest access is often enabled by default, effectively lowering the auth barrier to near-none, but this is an authenticated flaw and PR:N understates the (small) access requirement. Likewise the vendor's AV:A (adjacent) is unusual for a web-frontend PHP endpoint reachable over the network; AV:N is more realistic and would slightly raise the score. Net: real, patch-worthy, but a resource-exhaustion nuisance rather than a priority remote-code or data-breach threat. |
| Exploit ScenarioDerived | An attacker with any Zabbix frontend session - including a default-enabled Guest account - repeatedly sends specially crafted parameters to /imgstore.php, each request forcing disproportionate CPU work on the web server. Sustained requests exhaust CPU and degrade or deny the monitoring frontend for legitimate operators. No public proof-of-concept exploit was identified at the time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Sep 26, 2026
Denial of service in the Zabbix web frontend allows an authenticated user - including the built-in Guest account when Guest access is still enabled - to drive disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php. The vulnerable image-serving endpoint amplifies trivial requests into heavy server-side processing, so sustained requests can exhaust frontend CPU and impair availability of the Zabbix UI for legitimate operators. Affected builds span Zabbix 6.0.0-6.0.41, 7.0.0-7.0.18, 7.2.0-7.2.12 and 7.4.0-7.4.2; a vendor patch is available, EPSS is low (0.05%, 16th percentile), and no public exploit code or confirmed active exploitation was identified at time of analysis.
Earlier versions of this analysis (1)
RemediationAI
The primary fix is to apply the vendor-supplied Zabbix frontend update; patch availability is confirmed by the vendor (security@zabbix.com) via advisory ZBX-27284 (https://support.zabbix.com/browse/ZBX-27284), and upgrades on each affected branch should move past the impacted ranges - 6.0.0-6.0.41, 7.0.0-7.0.18, 7.2.0-7.2.12 and 7.4.0-7.4.2 - according to the versions published in that advisory, with Debian and Ubuntu users following bug#1121841 and their respective distribution updates. Where immediate patching is not possible, the highest-value compensating control is to disable the Guest account and require authenticated access to the frontend, since the flaw explicitly grants Guest-capable users the amplification primitive; the trade-off is that public/unauthenticated dashboard, map and graph sharing stops working, so verify which public links your deployment relies on first. Additional controls include restricting or rate-limiting requests to /imgstore.php at the reverse proxy or WAF, applying per-user and per-IP request throttling on the frontend, and capping the webserver/PHP-FPM worker pool CPU with resource limits (for example systemd CPUQuota or container CPU limits) so a single abusive session cannot saturate the host - each of these reduces the amplification amplitude but does not remove the underlying defect, and aggressive throttling may cause legitimate graph rendering to slow down. Given the absence of identified public exploit code and the low EPSS score, remediation can be scheduled through normal patch cycles rather than treated as an emergency.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is classified as CWE-405 (Asymmetric Resource Consumption / Amplification): a request whose cost to the client is small consumes a disproportionately large amount of server resources. The target is /imgstore.php, the PHP frontend component that retrieves and serves stored images (graphs, maps, icons) from the Zabbix database, identified by the CPE string cpe:2.3:a:zabbix:frontend. Because the frontend is written in PHP, crafted parameters reaching the image-retrieval logic can trigger expensive rendering or database work per request rather than per unit of input, giving an attacker a CPU amplification primitive. The vulnerability affects only the frontend tier; there is no confidentiality or integrity impact (C:N/I:N, A:H), and the official CVSS 4.0 vector (AV:A/AC:L/AT:P, A:H) scores 6.0. Our independent CVSS 3.1 assessment (AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H) reflects that the endpoint is reachable over the network but requires a low-privileged authenticated session, and the description explicitly notes that the Guest account qualifies - so environments that leave default Guest access enabled face a near-zero practical barrier, whereas disabling Guest and requiring real authentication meaningfully limits exposure. Debian and Ubuntu both track the issue (Debian bug#1121841; Ubuntu priority medium across nine releases), indicating downstream distribution packages are affected as well.
Know when Zabbix gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Web frontend is network-reachable (AV:N) and requires a low-privilege/Guest session (PR:L); asymmetric CPU consumption yields availability-only impact (A:H, C:N/I:N).
AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Primary rating from Vendor (zabbix).
CVSS VectorVendor: zabbix
Lifecycle Timeline
4DescriptionCVE.org
An authenticated Zabbix user (including Guest) is able to cause disproportionate CPU load on the webserver by sending specially crafted parameters to /imgstore.php, leading to potential denial of service.
Executive ViewAI
CVE-2025-49643 presents notable security risk rated CVSS 6.5. Exploitation could compromise the security of affected deployments. Organizations should apply vendor updates when available and monitor for exploitation.
Apply vendor patch. If patching is delayed: restrict network access and enable monitoring.
Threat Intelligence Overview
NVD
CVE.org
EPSS
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
SQL injection vulnerability in Zabbix before 2.2.14 and 3.0 before 3.0.4 allows remote attackers to execute arbitrary SQ
An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. Rated hi
The mysql user parameter configuration script (userparameter_mysql.conf) in the agent in Zabbix before 2.0.18, 2.2.x bef
A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in
Zabbix Frontend provides a feature that allows admins to maintain the installation and ensure that only certain IP addre
An issue was discovered in Grafana through 7.3.4, when integrated with Zabbix. Rated critical severity (CVSS 9.8), this
An issue was discovered in zabbix.php?action=dashboard.view&dashboardid=1 in Zabbix through 4.4. Rated critical severity
Zabbix server can perform command execution for configured scripts. Rated high severity (CVSS 8.8), this vulnerability i
SQL injection vulnerability in frontends/php/popup_bitem.php in Zabbix 1.8.15rc1 and earlier, and 2.x before 2.0.2rc1, a
Zabbix before 1.8.19rc1, 2.0 before 2.0.10rc1, and 2.2 before 2.2.1rc1 allows remote Zabbix servers and proxies to execu
Stored Cross-Site Scripting (XSS) in Zabbix 7.0.x and 7.4.x allows authenticated administrators with non-super privilege
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resul
Same technique Denial Of Service
View allVendor StatusVendor
Ubuntu
Priority: Medium| Release | Status | Version |
|---|---|---|
| trusty | needs-triage | - |
| xenial | needs-triage | - |
| bionic | needs-triage | - |
| focal | needs-triage | - |
| jammy | needs-triage | - |
| noble | DNE | - |
| questing | needs-triage | - |
| upstream | needs-triage | - |
| plucky | ignored | end of life, was needs-triage |
Debian
Bug #1121841| Release | Status | Fixed Version | Urgency |
|---|---|---|---|
| bullseye | vulnerable | 1:5.0.8+dfsg-1 | - |
| bullseye (security) | vulnerable | 1:5.0.47+dfsg-0+deb11u1 | - |
| bookworm | vulnerable | 1:6.0.14+dfsg-1 | - |
| trixie | fixed | 1:7.0.22+dfsg-1~deb13u1 | - |
| forky, sid | fixed | 1:7.0.22+dfsg-1 | - |
| (unstable) | fixed | 1:7.0.22+dfsg-1 | - |
SUSE
Severity: Medium| Product | Status |
|---|---|
| SUSE Linux Enterprise Server 12 SP5 | Fixed |
| SUSE Linux Enterprise Server 12 SP5-LTSS | Fixed |
| SUSE Linux Enterprise Server 12 SP5-LTSS Extended Security | Fixed |
| SUSE Linux Enterprise Server LTSS Extended Security 12 SP5 | Fixed |
| SUSE Linux Enterprise Server 12 SP3-BCL | Fixed |
| SUSE Linux Enterprise Server 12 SP3-ESPOS | Fixed |
| SUSE Linux Enterprise Server 12 SP3-LTSS | Fixed |
| SUSE Linux Enterprise Server 12 SP4 | Fixed |
| SUSE Linux Enterprise Server 12 SP4-ESPOS | Fixed |
| SUSE Linux Enterprise Server 12 SP4-LTSS | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 12 SP3 | Fixed |
| SUSE Linux Enterprise Server for SAP Applications 12 SP4 | Fixed |
| SUSE OpenStack Cloud 8 | Fixed |
| SUSE OpenStack Cloud 9 | Fixed |
| SUSE OpenStack Cloud Crowbar 8 | Fixed |
| SUSE OpenStack Cloud Crowbar 9 | Fixed |
GitHub PoC
Exploit-DB