Zabbix Server Vulnerable to AT Command Injection via SMS Notifications
CVE-2024-22122

3LOW

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
12 August 2024

What is CVE-2024-22122?

An input validation issue present in Zabbix Server allows an attacker to exploit the SMS notification feature by injecting malicious AT commands through a specially crafted phone number. Specifically, the lack of validation for the 'Number' field on both the web interface and the server side enables remote adversaries to craft SMS notifications that can execute unauthorized commands on the connected modem. This vulnerability poses a significant threat to the integrity and availability of the system, potentially compromising sensitive operations.

Affected Version(s)

Zabbix 5.0.0 <= 5.0.42

Zabbix 6.0.0 <= 6.0.30

Zabbix 6.4.0 <= 6.4.15

References

https://support.zabbix.com/browse/ZBX-25012

CVSS V3.1

Score:
3
Severity:
LOW
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
High
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zabbix wants to thank Maksim Tiukov (mf0cuz) who submitted this report in HackerOne bug bounty platform
.