CVE-2022-43515

What it actually does

The flaw allows unauthenticated remote attackers to bypass the IP address allow-list that admins configure to restrict access during maintenance mode, granting full access to the Zabbix Frontend.

Why it matters to the business

Attackers can reach the monitoring console and any sensitive configuration or operational data it exposes, increasing the chance of system compromise and loss of visibility into infrastructure health.

How an attack unfolds

An attacker discovers a Zabbix Frontend instance with maintenance-mode IP restrictions enabled, crafts requests that evade the IP check (commonly via header manipulation or alternate request paths), and gains unauthenticated administrative access to the console.

How to fix it

Disable the maintenance-mode IP restriction feature until a code-level fix is available, enforce access only through a VPN or reverse proxy with its own allow-list, and monitor for new Zabbix releases that address the authorization logic.

How to confirm the fix worked

Attempt connections from an IP outside the configured range after applying controls; verify that requests are still denied. Review web-server access logs for entries showing successful requests from disallowed addresses.

Typical attack path

1. Identify publicly reachable Zabbix Frontend endpoints
2. Confirm maintenance-mode IP restriction is active
3. Send crafted requests that bypass the IP allow-list check
4. Obtain full unauthenticated access to the web console
5. Escalate to data exfiltration or further lateral movement

How to detect it

Inspect web-server and Zabbix access logs for successful HTTP requests to frontend pages originating from IP addresses that should have been blocked by maintenance mode; correlate with authentication events that bypass expected IP checks.

What your security team should do

• Immediately restrict Zabbix Frontend exposure to trusted networks only
• Implement an external reverse proxy or WAF rule that enforces IP allow-listing before traffic reaches the application
• Enable detailed logging of all authentication and access attempts
• Subscribe to Zabbix security announcements for a future patch
• Treat the instance as high-risk until the authorization bypass is resolved