CVE-2022-23134: Zabbix Frontend setup.php improper access control
The short version: After initial setup, some steps of the Zabbix Frontend's setup.php remain reachable by unauthenticated users rather than only super-administrators (CVE-2022-23134), letting an attacker pass step checks and potentially alter frontend configuration. The impact is bounded, but it's in CISA's KEV catalog and a fix exists. Patch it in due course, sooner if exposed. Steady hands.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Moderate — bounded impact, but KEV-listed (see below) |
| CVSS v3.1 (NVD) | 5.3 — Medium · AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N |
| CVSS (Zabbix, CNA) | 3.7 — Low · AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N |
| EPSS | ~84.7% · 99.7th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2022-03-08 |
| Known exploited? | Yes — KEV-listed |
| Vulnerability type | CWE-284 / CWE-287 improper access control → unauthenticated access to setup steps |
| Requires authenticated session? | No — pre-authentication |
| Affected | Zabbix Frontend (see vendor advisory ZBX-20384 for exact versions) |
| Fixed in | The patched Zabbix Frontend releases per ZBX-20384 |
What you need to know
CVE-2022-23134 is an improper access control flaw in the Zabbix Frontend. After the initial setup process completes, several steps of setup.php are still reachable by unauthenticated users — not just super-administrators. A malicious actor can pass the step checks and potentially change parts of the frontend configuration.
The honest framing is a limited-impact bug with a strong prioritization signal:
- The mechanical impact is narrow. The CVSS vectors reflect a low, integrity-only effect — configuration influence, not code execution or wholesale data theft.
- But it's pre-authentication and KEV-listed. Being reachable without credentials on an internet-facing monitoring frontend, and appearing in CISA's catalog, is why it still deserves attention.
How serious we see it
Moderate — bounded, but don't ignore the KEV flag.
Both the NVD (5.3) and Zabbix (3.7) scores put this in the lower bands, and rightly so — the practical impact is limited to unauthenticated access to setup steps and configuration influence, not a straight path to takeover. We rate it Moderate rather than Low because it's unauthenticated, exposed frontends are common, and CISA lists it as known-exploited. The reassuring part is that it's fully addressable: a published fix, and exposure you can confirm quickly.
Recommendations
Straight from Zabbix's advisory (ZBX-20384) and CISA:
- Patch. Upgrade the Zabbix Frontend to a fixed release per ZBX-20384.
- Restrict exposure. Keep the Zabbix Frontend off the open internet; limit it to trusted networks or a VPN.
- Review configuration. Confirm frontend settings weren't tampered with if an unpatched instance was internet-facing.
- Confirm your exposure first. Verify whether a Zabbix Frontend is internet-facing and which version it runs.
How BreachRisk sees it
BreachRisk discovers internet-facing Zabbix frontends from the outside, fingerprints the product and version, and flags exposure tied to this KEV-listed CVE so it rises above ordinary low-severity noise. Where safe verification is possible, it issues a bounded, non-destructive request to the setup step and checks the response for the improper-access behavior — confirming the exposure rather than assuming it from a version string. That's the difference between "this looks like a vulnerable Zabbix" and "we confirmed the setup steps are reachable."