CVE-2022-43516: Zabbix Agent installer adds “allow all TCP any any” firewall rule

Severity: critical (CVSS 9.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.0% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-12-12 · updated 2026-06-17
Weakness: CWE-16

Description

A Firewall Rule which allows all incoming TCP connections to all programs from any source and to all ports is created in Windows Firewall after Zabbix agent installation (MSI)

Affected products

Microsoft Windows Firewall: all versions
Zabbix: from 6.0.10 before 6.0.12; from 6.2.0 before 6.2.6; 6.0.12-rc1, 6.2.6-rc1 — fixed in 6.0.12, 6.2.6
Zabbix agent 2 (MSI packages): from Oct. 29, 2022 through Dec 2, 2022 — fixed in Dec 3, 2022
Zabbix agent (MSI packages): from Oct. 29, 2022 through Dec 2, 2022 — fixed in Dec 3, 2022

How to fix

Upgrade to a fixed version: Zabbix 6.0.12, 6.2.6; Zabbix agent 2 (MSI packages) Dec 3, 2022; Zabbix agent (MSI packages) Dec 3, 2022. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2022-43516 or the next vulnerability affects your stack