CVE-2024-22122
Severity CVSS v4.0:
Pending analysis
Type:
CWE-77
Command Injection
Publication date:
12/08/2024
Last modified:
03/11/2025
Description
Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.
Impact
Base Score 3.x
3.00
Severity 3.x
LOW
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* | 5.0.0 (including) | 5.0.42 (including) |
| cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* | 6.0.0 (including) | 6.0.30 (including) |
| cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:* | 6.4.0 (including) | 6.4.15 (including) |
| cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:* | ||
| cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:* | ||
| cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:* | ||
| cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:* | ||
| cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:* | ||
| cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:* | ||
| cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:* | ||
| cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:* | ||
| cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:* | ||
| cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:* | ||
| cpe:2.3:a:zabbix:zabbix:7.0.0:beta2:*:*:*:*:*:* | ||
| cpe:2.3:a:zabbix:zabbix:7.0.0:beta3:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page