Vulnerability-Lookup

WID-SEC-W-2025-2042

Vulnerability from csaf_certbund - Published: 2025-09-11 22:00 - Updated: 2025-09-14 22:00

Summary

Zabbix: Mehrere Schwachstellen

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.

Angriff

Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in Zabbix ausnutzen, um Informationen offenzulegen, Code auszuführen und eine SQL-Injection durchzuführen.

Betroffene Betriebssysteme

- Linux - Sonstiges - UNIX

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in Zabbix ausnutzen, um Informationen offenzulegen, Code auszuf\u00fchren und eine SQL-Injection durchzuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Sonstiges\n- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2025-2042 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2025/wid-sec-w-2025-2042.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2025-2042 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2025-2042"
      },
      {
        "category": "external",
        "summary": "ZABBIX BUGS AND ISSUES ZBX-26985 vom 2025-09-11",
        "url": "https://support.zabbix.com/browse/ZBX-26985"
      },
      {
        "category": "external",
        "summary": "ZABBIX BUGS AND ISSUES ZBX-26986 vom 2025-09-11",
        "url": "https://support.zabbix.com/browse/ZBX-26986"
      },
      {
        "category": "external",
        "summary": "ZABBIX BUGS AND ISSUES ZBX-26987 vom 2025-09-11",
        "url": "https://support.zabbix.com/browse/ZBX-26987"
      },
      {
        "category": "external",
        "summary": "ZABBIX BUGS AND ISSUES ZBX-26988 vom 2025-09-11",
        "url": "https://support.zabbix.com/browse/ZBX-26988"
      }
    ],
    "source_lang": "en-US",
    "title": "Zabbix: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2025-09-14T22:00:00.000+00:00",
      "generator": {
        "date": "2025-09-15T07:42:03.442+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.4.0"
        }
      },
      "id": "WID-SEC-W-2025-2042",
      "initial_release_date": "2025-09-11T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2025-09-11T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-09-14T22:00:00.000+00:00",
          "number": "2",
          "summary": "Referenz(en) aufgenommen: EUVD-2025-29033, EUVD-2025-29035, EUVD-2025-29034, EUVD-2025-29036"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c6.0.19",
                "product": {
                  "name": "Zabbix Zabbix \u003c6.0.19",
                  "product_id": "1437137"
                }
              },
              {
                "category": "product_version",
                "name": "6.0.19",
                "product": {
                  "name": "Zabbix Zabbix 6.0.19",
                  "product_id": "1437137-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zabbix:zabbix:6.0.19:-"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c5.0.47",
                "product": {
                  "name": "Zabbix Zabbix \u003c5.0.47",
                  "product_id": "T046953"
                }
              },
              {
                "category": "product_version",
                "name": "5.0.47",
                "product": {
                  "name": "Zabbix Zabbix 5.0.47",
                  "product_id": "T046953-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zabbix:zabbix:5.0.47"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c6.0.34",
                "product": {
                  "name": "Zabbix Zabbix \u003c6.0.34",
                  "product_id": "T046954"
                }
              },
              {
                "category": "product_version",
                "name": "6.0.34",
                "product": {
                  "name": "Zabbix Zabbix 6.0.34",
                  "product_id": "T046954-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zabbix:zabbix:6.0.34"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.0.4",
                "product": {
                  "name": "Zabbix Zabbix \u003c7.0.4",
                  "product_id": "T046955"
                }
              },
              {
                "category": "product_version",
                "name": "7.0.4",
                "product": {
                  "name": "Zabbix Zabbix 7.0.4",
                  "product_id": "T046955-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zabbix:zabbix:7.0.4"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c6.0.40",
                "product": {
                  "name": "Zabbix Zabbix \u003c6.0.40",
                  "product_id": "T046956"
                }
              },
              {
                "category": "product_version",
                "name": "6.0.40",
                "product": {
                  "name": "Zabbix Zabbix 6.0.40",
                  "product_id": "T046956-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zabbix:zabbix:6.0.40"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.0.11",
                "product": {
                  "name": "Zabbix Zabbix \u003c7.0.11",
                  "product_id": "T046957"
                }
              },
              {
                "category": "product_version",
                "name": "7.0.11",
                "product": {
                  "name": "Zabbix Zabbix 7.0.11",
                  "product_id": "T046957-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zabbix:zabbix:7.0.11"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.2.5",
                "product": {
                  "name": "Zabbix Zabbix \u003c7.2.5",
                  "product_id": "T046958"
                }
              },
              {
                "category": "product_version",
                "name": "7.2.5",
                "product": {
                  "name": "Zabbix Zabbix 7.2.5",
                  "product_id": "T046958-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zabbix:zabbix:7.2.5"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.0.14",
                "product": {
                  "name": "Zabbix Zabbix \u003c7.0.14",
                  "product_id": "T046959"
                }
              },
              {
                "category": "product_version",
                "name": "7.0.14",
                "product": {
                  "name": "Zabbix Zabbix 7.0.14",
                  "product_id": "T046959-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zabbix:zabbix:7.0.14"
                  }
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c7.2.8",
                "product": {
                  "name": "Zabbix Zabbix \u003c7.2.8",
                  "product_id": "T046960"
                }
              },
              {
                "category": "product_version",
                "name": "7.2.8",
                "product": {
                  "name": "Zabbix Zabbix 7.2.8",
                  "product_id": "T046960-fixed",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:zabbix:zabbix:7.2.8"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Zabbix"
          }
        ],
        "category": "vendor",
        "name": "Zabbix"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2025-27233",
      "product_status": {
        "known_affected": [
          "T046954",
          "T046955",
          "T046953",
          "T046958",
          "T046956",
          "T046957",
          "1437137"
        ]
      },
      "release_date": "2025-09-11T22:00:00.000+00:00",
      "title": "CVE-2025-27233"
    },
    {
      "cve": "CVE-2025-27234",
      "product_status": {
        "known_affected": [
          "T046953"
        ]
      },
      "release_date": "2025-09-11T22:00:00.000+00:00",
      "title": "CVE-2025-27234"
    },
    {
      "cve": "CVE-2025-27238",
      "product_status": {
        "known_affected": [
          "T046955",
          "T046958",
          "T046959",
          "T046957",
          "T046960"
        ]
      },
      "release_date": "2025-09-11T22:00:00.000+00:00",
      "title": "CVE-2025-27238"
    },
    {
      "cve": "CVE-2025-27240",
      "product_status": {
        "known_affected": [
          "T046954",
          "T046955",
          "T046953",
          "T046959",
          "1437137"
        ]
      },
      "release_date": "2025-09-11T22:00:00.000+00:00",
      "title": "CVE-2025-27240"
    }
  ]
}

CVE-2025-27238 (GCVE-0-2025-27238)

Vulnerability from cvelistv5 – Published: 2025-09-12 10:33 – Updated: 2025-09-15 18:48

Title

API hostprototype.get lists data to users with insufficient authorization.

Summary

Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.

Severity ?

2.1 (Low)


                        
                          CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

Assigner

Zabbix

References

URL

Tags

https://support.zabbix.com/browse/ZBX-26988

Impacted products

	Vendor	Product	Version
	Zabbix	Zabbix	Affected: 7.0.0 , ≤ 7.0.13 (git) Affected: 7.2.0 , ≤ 7.2.7 (git)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27238",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-12T11:54:14.863048Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-284",
                "description": "CWE-284 Improper Access Control",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-15T18:48:19.882Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "API"
          ],
          "product": "Zabbix",
          "repo": "https://git.zabbix.com/",
          "vendor": "Zabbix",
          "versions": [
            {
              "changes": [
                {
                  "at": "7.0.14",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.0.13",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "7.2.8",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.2.7",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn attacker could retrieve a list of all host prototypes from API if they have access to a low privilege user account with no user roles assigned.\u003c/p\u003e"
            }
          ],
          "value": "An attacker could retrieve a list of all host prototypes from API if they have access to a low privilege user account with no user roles assigned."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDue to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.\u003c/p\u003e"
            }
          ],
          "value": "Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them."
        }
      ],
      "impacts": [
        {
          "descriptions": [
            {
              "lang": "en",
              "value": ":"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 2.1,
            "baseSeverity": "LOW",
            "privilegesRequired": "LOW",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": ":",
              "lang": "en"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-12T10:33:17.753Z",
        "orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
        "shortName": "Zabbix"
      },
      "references": [
        {
          "url": "https://support.zabbix.com/browse/ZBX-26988"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate the affected components to their respective fixed versions.\u003c/p\u003e"
            }
          ],
          "value": "Update the affected components to their respective fixed versions."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "API hostprototype.get lists data to users with insufficient authorization.",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eMake sure there are no Zabbix users without a user group.\u003c/p\u003e"
            }
          ],
          "value": "Make sure there are no Zabbix users without a user group."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
    "assignerShortName": "Zabbix",
    "cveId": "CVE-2025-27238",
    "datePublished": "2025-09-12T10:33:17.753Z",
    "dateReserved": "2025-02-20T11:40:38.480Z",
    "dateUpdated": "2025-09-15T18:48:19.882Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-27233 (GCVE-0-2025-27233)

Vulnerability from cvelistv5 – Published: 2025-09-12 10:32 – Updated: 2025-09-12 11:58

Title

Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.

Summary

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.

Severity ?

5.7 (Medium)


                        
                          CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

CWE

CWE-77 - Improper Neutralization of Special Elements used in a Command ('Command Injection')

Assigner

Zabbix

References

URL

Tags

https://support.zabbix.com/browse/ZBX-26987

Impacted products

	Vendor	Product	Version
	Zabbix	Zabbix	Affected: 6.0.0 , ≤ 6.0.39 (git) Affected: 7.0.0 , ≤ 7.0.10 (git) Affected: 7.2.0 , ≤ 7.2.4 (git)

Credits

Zabbix wants to thank kelsier for submitting this report on the HackerOne bug bounty platform.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27233",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-12T11:57:58.701448Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-12T11:58:28.618Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "Agent2 plugin"
          ],
          "product": "Zabbix",
          "repo": "https://git.zabbix.com/",
          "vendor": "Zabbix",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.0.40",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.0.39",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "7.0.11",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.0.10",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "7.2.5",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.2.4",
              "status": "affected",
              "version": "7.2.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric.\u003c/p\u003e"
            }
          ],
          "value": "An attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Zabbix wants to thank kelsier for submitting this report on the HackerOne bug bounty platform."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eZabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.\u003c/p\u003e"
            }
          ],
          "value": "Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88: OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "HIGH",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 5.7,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-77",
              "description": "CWE-77: Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-12T10:32:36.174Z",
        "orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
        "shortName": "Zabbix"
      },
      "references": [
        {
          "url": "https://support.zabbix.com/browse/ZBX-26987"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate the affected components to their respective fixed versions.\u003c/p\u003e"
            }
          ],
          "value": "Update the affected components to their respective fixed versions."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRemove smartctl or use strict item key parameter validation with AllowKey/DenyKey.\u003c/p\u003e"
            }
          ],
          "value": "Remove smartctl or use strict item key parameter validation with AllowKey/DenyKey."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
    "assignerShortName": "Zabbix",
    "cveId": "CVE-2025-27233",
    "datePublished": "2025-09-12T10:32:36.174Z",
    "dateReserved": "2025-02-20T11:40:38.480Z",
    "dateUpdated": "2025-09-12T11:58:28.618Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-27240 (GCVE-0-2025-27240)

Vulnerability from cvelistv5 – Published: 2025-09-12 10:33 – Updated: 2025-09-15 12:49

Title

Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host

Summary

A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.

Severity ?

7.5 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Assigner

Zabbix

References

URL

Tags

https://support.zabbix.com/browse/ZBX-26986

Impacted products

	Vendor	Product	Version
	Zabbix	Zabbix	Affected: 6.0.0 , ≤ 6.0.33 (git) Affected: 6.4.0 , ≤ 6.4.18 (git) Affected: 7.0.0 , ≤ 7.0.3 (git)

Credits

Zabbix wants to thank Grzegorz Muszyński (szerszen199) for submitting this report on the HackerOne bug bounty platform.

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27240",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-12T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-13T03:55:33.647Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "Server"
          ],
          "product": "Zabbix",
          "repo": "https://git.zabbix.com/",
          "vendor": "Zabbix",
          "versions": [
            {
              "changes": [
                {
                  "at": "6.0.34",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.0.33",
              "status": "affected",
              "version": "6.0.0",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "6.4.19",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "6.4.18",
              "status": "affected",
              "version": "6.4.0",
              "versionType": "git"
            },
            {
              "changes": [
                {
                  "at": "7.0.4",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "7.0.3",
              "status": "affected",
              "version": "7.0.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eThe attacker needs to be a Zabbix administrator and also needs access to a host that is later auto-removed.\u003c/p\u003e"
            }
          ],
          "value": "The attacker needs to be a Zabbix administrator and also needs access to a host that is later auto-removed."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "reporter",
          "value": "Zabbix wants to thank Grzegorz Muszy\u0144ski (szerszen199) for submitting this report on the HackerOne bug bounty platform."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eA Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the \u0027Visible name\u0027 field.\u003c/p\u003e"
            }
          ],
          "value": "A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the \u0027Visible name\u0027 field."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-66",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-66: SQL Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-89",
              "description": "CWE-89: Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-15T12:49:03.144Z",
        "orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
        "shortName": "Zabbix"
      },
      "references": [
        {
          "url": "https://support.zabbix.com/browse/ZBX-26986"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate the affected components to their respective fixed versions.\u003c/p\u003e"
            }
          ],
          "value": "Update the affected components to their respective fixed versions."
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eDisable any Autoregistration actions that remove hosts.\u003c/p\u003e"
            }
          ],
          "value": "Disable any Autoregistration actions that remove hosts."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
    "assignerShortName": "Zabbix",
    "cveId": "CVE-2025-27240",
    "datePublished": "2025-09-12T10:33:46.484Z",
    "dateReserved": "2025-02-20T11:40:38.480Z",
    "dateUpdated": "2025-09-15T12:49:03.144Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2025-27234 (GCVE-0-2025-27234)

Vulnerability from cvelistv5 – Published: 2025-09-12 10:31 – Updated: 2025-09-13 03:55

Title

Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.

Summary

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.

Severity ?

7.3 (High)


                        
                          CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Assigner

Zabbix

References

URL

Tags

https://support.zabbix.com/browse/ZBX-26985

Impacted products

	Vendor	Product	Version
	Zabbix	Zabbix	Affected: 5.0.0 , ≤ 5.0.46 (git)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2025-27234",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-09-12T00:00:00+00:00",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-09-13T03:55:34.603Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unknown",
          "modules": [
            "Agent2 plugin"
          ],
          "product": "Zabbix",
          "repo": "https://git.zabbix.com/",
          "vendor": "Zabbix",
          "versions": [
            {
              "changes": [
                {
                  "at": "5.0.47",
                  "status": "unaffected"
                }
              ],
              "lessThanOrEqual": "5.0.46",
              "status": "affected",
              "version": "5.0.0",
              "versionType": "git"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eAn attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric.\u003c/p\u003e"
            }
          ],
          "value": "An attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric."
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eZabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.\u003c/p\u003e"
            }
          ],
          "value": "Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88: OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "ADJACENT",
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "privilegesRequired": "HIGH",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "HIGH",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "HIGH",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78: Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-09-12T10:31:58.770Z",
        "orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
        "shortName": "Zabbix"
      },
      "references": [
        {
          "url": "https://support.zabbix.com/browse/ZBX-26985"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eUpdate the affected components to their respective fixed versions.\u003c/p\u003e"
            }
          ],
          "value": "Update the affected components to their respective fixed versions."
        }
      ],
      "source": {
        "discovery": "INTERNAL"
      },
      "title": "Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.",
      "workarounds": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cp\u003eRemove smartctl or use strict item key parameter validation with AllowKey/DenyKey.\u003c/p\u003e"
            }
          ],
          "value": "Remove smartctl or use strict item key parameter validation with AllowKey/DenyKey."
        }
      ],
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8",
    "assignerShortName": "Zabbix",
    "cveId": "CVE-2025-27234",
    "datePublished": "2025-09-12T10:31:58.770Z",
    "dateReserved": "2025-02-20T11:40:38.480Z",
    "dateUpdated": "2025-09-13T03:55:34.603Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Tags

Taxonomy of the tags.

All sightings related to this event Export sightings related to this event

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2025-2042

CVE-2025-27238 (GCVE-0-2025-27238)

CVE-2025-27233 (GCVE-0-2025-27233)

CVE-2025-27240 (GCVE-0-2025-27240)

CVE-2025-27234 (GCVE-0-2025-27234)

Tags

Sightings

Nomenclature