Zabbix Server Vulnerable to AT Command Injection via SMS Notifications

CVE-2024-22122

What is CVE-2024-22122?

An input validation issue present in Zabbix Server allows an attacker to exploit the SMS notification feature by injecting malicious AT commands through a specially crafted phone number. Specifically, the lack of validation for the 'Number' field on both the web interface and the server side enables remote adversaries to craft SMS notifications that can execute unauthorized commands on the connected modem. This vulnerability poses a significant threat to the integrity and availability of the system, potentially compromising sensitive operations.

References