VulnerabilityModified

CVE-2024-22122

Zabbix allows to configure SMS notifications.

CRITICAL 9.1EPSS 1.61%

Does this matter?

High impact if exploited, but EPSS currently rates exploitation as unlikely (1.61%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.

Description

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.

CVSS 3.1: 9.1 CRITICALCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
EPSS: 1.61% probability · 74th percentile
CISA KEV: Not listed
Weakness: CWE-77
Affected: zabbix/zabbix
Source: security@zabbix.com

References

https://support.zabbix.com/browse/ZBX-25012Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.