CVE-2022-22704

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.3% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-06 · updated 2026-06-17
Weakness: CWE-909

Description

The zabbix-agent2 package before 5.4.9-r1 for Alpine Linux sometimes allows privilege escalation to root because the design incorrectly expected that systemd would (in effect) determine part of the configuration.

Affected products

Zabbix-Agent2: before 5.4.9; 5.4.9 — fixed in 5.4.9

How to fix

Upgrade to a fixed version: Zabbix-Agent2 5.4.9. Check the vendor advisory for mitigations.

References

https://gitlab.alpinelinux.org/alpine/aports/-/issues/13368
https://gitlab.alpinelinux.org/alpine/aports/-/issues/13368

Get alerted when CVE-2022-22704 or the next vulnerability affects your stack