CVE-2024-22122
LOW severity · CVSS 3 · Command injection
3CVSS LOW
Summary
Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.
Impact & exploitability
Attack vectorNetwork
Attack complexityHigh
Privileges requiredHigh
User interactionNone
Confidentiality impactNone
Integrity impactLow
Availability impactNone
Exploit probability (EPSS)2%
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.