CVE-2025-27234
EPSS 0.16%zabbix - security update
Published: 9/12/2025Modified: 4/28/2026
Also known as:DEBIAN-CVE-2025-27234DLA-4473-1
Description
Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.
Affected packages (2)
- Debian/zabbixfrom 0, < 1:5.0.47+dfsg-0+deb11u1
- Debian/zabbixfrom 0, < 1:5.0.47+dfsg-0+deb11u1
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 4.0 | — | CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |