Summary
Ein Angreifer aus einem angrenzenden Netzwerk kann mehrere Schwachstellen in Zabbix ausnutzen, um Informationen offenzulegen, Code auszuführen und eine SQL-Injection durchzuführen.
Product
Zabbix ist ein Open-Source Netzwerk-Monitoringsystem.
Vulnerabilities 4
-
High 7.5
Secondary-order SQL injection in Zabbix Server when deleting an autoregistered host
A Zabbix adminitrator can inject arbitrary SQL during the autoremoval of hosts by inserting malicious SQL in the 'Visible name' field.
-
High 7.3
Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.
Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.
-
Medium 5.7
Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.
Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.
-
Low 2.1
API hostprototype.get lists data to users with insufficient authorization.
Due to a bug in Zabbix API, the hostprototype.get method lists all host prototypes to users that do not have any user groups assigned to them.
Revision history
-
#3
Neue Updates von Debian aufgenommen
-
#2
Referenz(en) aufgenommen: EUVD-2025-29033, EUVD-2025-29035, EUVD-2025-29034, EUVD-2025-29036
-
#1
Initiale Fassung
References
-
ZABBIX BUGS AND ISSUES ZBX-26985 vom 2025-09-11
https://support.zabbix.com/browse/ZBX-26985
-
ZABBIX BUGS AND ISSUES ZBX-26986 vom 2025-09-11
https://support.zabbix.com/browse/ZBX-26986
-
ZABBIX BUGS AND ISSUES ZBX-26987 vom 2025-09-11
https://support.zabbix.com/browse/ZBX-26987
-
ZABBIX BUGS AND ISSUES ZBX-26988 vom 2025-09-11
https://support.zabbix.com/browse/ZBX-26988
-
Debian Security Advisory DLA-4473 vom 2026-02-08
https://lists.debian.org/debian-lts-announce/2026/02/msg00012.html