Command Injection Vulnerability in Zabbix Agent 2 by Zabbix
CVE-2025-27233

5.7MEDIUM

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
12 September 2025

What is CVE-2025-27233?

The Zabbix Agent 2 smartctl plugin has a command injection vulnerability due to improper sanitization of parameters in the smart.disk.get function. An attacker may exploit this flaw to inject malicious arguments into the smartctl command, potentially leading to the exposure of sensitive information, such as the NTLMv2 hash from Windows systems. Proper validation and sanitization of input parameters are crucial to mitigate this risk.

Affected Version(s)

Zabbix 6.0.0 <= 6.0.39

Zabbix 7.0.0 <= 7.0.10

Zabbix 7.2.0 <= 7.2.4

References

https://support.zabbix.com/browse/ZBX-26987

CVSS V4

Score:
5.7
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
High
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zabbix wants to thank kelsier for submitting this report on the HackerOne bug bounty platform.
.
CVE-2025-27233 : Command Injection Vulnerability in Zabbix Agent 2 by Zabbix