CVE-2024-22122

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-22122
Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.

3.0 /10

CVSS v3 : LOW

V3 Legend

Vector :

Exploitability : 1.3 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References
Link Resource
https://support.zabbix.com/browse/ZBX-25012 Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:beta2:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:rc2:*:*:*:*:*:*
History

10 Dec 2024, 19:21

Type Values Removed Values Added
References () https://support.zabbix.com/browse/ZBX-25012 - () https://support.zabbix.com/browse/ZBX-25012 - Vendor Advisory
First Time Zabbix zabbix
Zabbix
Summary
  • (es) Zabbix permite configurar notificaciones por SMS. La inyección del comando AT ocurre en el "Servidor Zabbix" porque no hay validación del campo "Número" en la Web ni en el lado del servidor Zabbix. El atacante puede ejecutar una prueba de SMS proporcionando un número de teléfono especialmente manipulado y ejecutar comandos AT adicionales en el módem.
CPE cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:rc1:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:beta3:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:rc2:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*
cpe:2.3:a:zabbix:zabbix:7.0.0:beta2:*:*:*:*:*:*

12 Aug 2024, 13:41

Type Values Removed Values Added
New CVE
Information

Published : 2024-08-12 13:38

Updated : 2024-12-10 19:21

NVD link : CVE-2024-22122

Mitre link : CVE-2024-22122

CVE.ORG link : CVE-2024-22122

JSON object : View

Products Affected

zabbix

  • zabbix
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')