CVE-2024-22122

Summary

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.

Affected Software

VendorProductVersion RangeStatus
ZabbixZabbix5.0.0 <= 5.0.42affected
ZabbixZabbix6.0.0 <= 6.0.30affected
ZabbixZabbix6.4.0 <= 6.4.15affected
ZabbixZabbix7.0.0alpha1 <= 7.0.0rc2affected

Weaknesses

  • CWE-77: CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

ADP Enrichment

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: partial

CVE Program Container

Additional References

References