by Kastro
Paper/Archive/CVE-2024-22122

CVE-2024-22122

Zabbix Zabbix — AT(GSM) Command Injection

EPSS 2%CVSS 9.1
critical.is priorityof 100
43
CVSS 9.1 (NVD)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 75.9.759 × 2015.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.

Affected

ProductAffectedFixed inSource
Zabbix5.0.0 – 5.0.42–CNA
Zabbix6.0.0 – 6.0.30–CNA
Zabbix6.4.0 – 6.4.15–CNA
Zabbix7.0.0alpha1 – 7.0.0rc2–CNA

Scores by source

NVD9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Zabbix (CNA)3.0CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: partial

References

refsupport.zabbix.com/browse/ZBX-25012reflists.debian.org/debian-lts-announce/2024/10/msg00000.html