VULNERABILITY INTELLIGENCE

CVE-2024-22122

CVSS score3 LOW
EPSS probability1.61%
CISA KEVNot currently listed
Published2024-08-12
Last modified2026-06-17
CVSS vectorCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N

Description

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.

Weakness classification

  • security@zabbix.com: CWE-77
  • nvd@nist.gov: CWE-77

Primary references