CVE-2025-49643 Overview
CVE-2025-49643 is a denial-of-service vulnerability in the Zabbix Frontend web interface. An authenticated Zabbix user, including accounts with the Guest role, can send specially crafted parameters to the /imgstore.php endpoint. The request causes disproportionate CPU load on the webserver, degrading service availability for other users.
The issue is categorized as an asymmetric resource consumption weakness [CWE-405]. The vulnerability requires only network adjacency and any authenticated session, which lowers the barrier for exploitation in environments where Guest access remains enabled.
Critical Impact
Any authenticated Zabbix user, including Guest accounts, can trigger CPU exhaustion on the webserver through crafted /imgstore.php parameters, resulting in denial of service for monitoring operations.
Affected Products
- Zabbix Frontend (multiple versions per vendor advisory)
- Deployments exposing /imgstore.php to authenticated users
- Instances with Guest access enabled are particularly exposed
Discovery Timeline
- 2025-12-01 - CVE-2025-49643 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-49643
Vulnerability Analysis
The vulnerability resides in the Zabbix Frontend script /imgstore.php, which handles image retrieval within the monitoring web interface. Specific parameter values cause the server-side processing routine to consume excessive CPU resources during request handling.
Because the endpoint accepts input from any authenticated session, an attacker holding a low-privilege account can issue crafted requests. Repeated requests amplify CPU load and can starve legitimate monitoring traffic. This aligns with an asymmetric resource consumption pattern in which the client-supplied input triggers work disproportionate to the request size.
Refer to the Zabbix Issue Tracker Entry ZBX-27284 for vendor-provided technical detail.
Root Cause
The root cause is insufficient bounds and validation on parameters processed by /imgstore.php. The processing logic performs work whose cost scales aggressively with attacker-controlled input, without applying limits appropriate to the request context. This qualifies as an algorithmic complexity weakness under [CWE-405].
Attack Vector
Exploitation requires an authenticated session on the Zabbix Frontend and network access to the web interface. The Guest role is sufficient when it is enabled. The attacker sends HTTP requests to /imgstore.php with parameter values crafted to force expensive server-side computation. No user interaction is required beyond the attacker's own authenticated session.
No verified public proof-of-concept code is available. The vulnerability manifests through parameter manipulation against the /imgstore.php endpoint. See the vendor advisory linked above for technical details.
Detection Methods for CVE-2025-49643
Indicators of Compromise
- Sustained high CPU utilization on the Zabbix Frontend webserver process without a corresponding increase in legitimate user activity
- Repeated HTTP requests to /imgstore.php from a single authenticated session or client IP
- Web server access logs showing anomalous parameter values or unusually long query strings targeting /imgstore.php
- Slow response times or timeouts across the Zabbix web interface during targeted request bursts
Detection Strategies
- Monitor webserver process CPU consumption and correlate spikes with access log entries for /imgstore.php
- Establish request-rate baselines per authenticated user and alert on deviations targeting image-serving endpoints
- Inspect authentication logs for active Guest role sessions and flag when Guest accounts issue repeated /imgstore.php requests
Monitoring Recommendations
- Enable verbose web access logging for /imgstore.php and forward logs to a centralized log platform for correlation
- Track CPU load average and per-process utilization on Zabbix Frontend hosts with alert thresholds tuned to normal operating ranges
- Review Zabbix audit logs for authentication events from Guest and other low-privilege accounts on a recurring cadence
How to Mitigate CVE-2025-49643
Immediate Actions Required
- Apply the vendor-supplied update referenced in ZBX-27284 once available for your Zabbix Frontend version
- Disable the Guest role if it is not required for operational monitoring workflows
- Restrict network access to the Zabbix Frontend to trusted management networks using firewall or reverse proxy controls
Patch Information
Zabbix tracks the fix through issue ZBX-27284. Consult the issue tracker for fixed release versions applicable to your deployment branch, and follow the vendor's standard upgrade procedure for the Zabbix Frontend package.
Workarounds
- Disable the Guest user role in Zabbix administrative settings to remove the unauthenticated-adjacent attack surface
- Place a reverse proxy or web application firewall in front of the Zabbix Frontend to rate-limit requests to /imgstore.php per source and per session
- Restrict /imgstore.php access at the web server layer to authorized user groups where feasible
- Monitor and cap CPU resources for the webserver process using cgroups or process manager limits to contain impact during an attack
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
