Skip to content
CVE PROGRAM SOURCE RECORD5.7 Medium

CVE-2025-27233

Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Zabbix

Description

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Zabbix Zabbix

Default version status: unknown

  • 6.0.0 to ≤ 6.0.39affected
  • 7.0.0 to ≤ 7.0.10affected
  • 7.2.0 to ≤ 7.2.4affected

References