CVE-2017-2825

HighCVSS 7.0/10Last modified Jun 17, 2026

Description

In the trapper functionality of Zabbix Server 2.4.x, specifically crafted trapper packets can pass database logic checks, resulting in database writes. An attacker can set up a Man-in-the-Middle server to alter trapper requests made between an active Zabbix proxy and Server to trigger this vulnerability.

Metrics

CVSS 3.0 7.0/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L

Affected software

VendorProductVersions
TalosZabbixZabbix Server 2.4.8.r1

References

Timeline

Published
Apr 20, 2018
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2017

CVE-2017-28263.7An information disclosure vulnerability exists in the iConfig proxy request of Zabbix server 2.4.X. A specially crafted iConfig proxy requesCVE-2017-28278.8An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicaCVE-2017-28288.8An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicaCVE-2017-28296.5An exploitable directory traversal vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running appliCVE-2017-28307.5An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicatiCVE-2017-28317.5An exploitable buffer overflow vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicatiCVE-2017-28327.2An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicaCVE-2017-28337.5An exploitable command injection vulnerability exists in the web management interface used by the Foscam C1 Indoor HD Camera running applicaCVE-2017-28347.0An exploitable code execution vulnerability exists in the authentication functionality of FreeRDP 2.0.0-beta1+android11. A specially craftedCVE-2017-28358.1An exploitable code execution vulnerability exists in the RDP receive functionality of FreeRDP 2.0.0-beta1+android11. A specially crafted seCVE-2017-28365.9An exploitable denial of service vulnerability exists within the reading of proprietary server certificates in FreeRDP 2.0.0-beta1+android11CVE-2017-28375.9An exploitable denial of service vulnerability exists within the handling of security data in FreeRDP 2.0.0-beta1+android11. A specially cra
CVE-2017-2825: High severity, CVSS 7.0 | Vulnix