Remote Code Execution Vulnerability in Zabbix Agent 2 by Zabbix
CVE-2025-27234

7.3HIGH

Key Information:

Vendor

Zabbix

Status
Zabbix
Vendor
CVE Published:
12 September 2025

What is CVE-2025-27234?

The Zabbix Agent 2 smartctl plugin is susceptible to a vulnerability where it fails to properly sanitize input parameters of the smart.disk.get command. This lack of validation enables attackers to manipulate the smartctl commands by injecting harmful parameters, potentially leading to remote code execution on the targeted system. To mitigate these risks, users should ensure they are running secure versions and apply any necessary patches as they become available.

Affected Version(s)

Zabbix 5.0.0 <= 5.0.46

References

https://support.zabbix.com/browse/ZBX-26985

CVSS V4

Score:
7.3
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.
CVE-2025-27234 : Remote Code Execution Vulnerability in Zabbix Agent 2 by Zabbix