CVE-2025-27234

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.

CVSS

No CVSS.

References

Link	Resource
https://support.zabbix.com/browse/ZBX-26985
https://lists.debian.org/debian-lts-announce/2026/02/msg00012.html

Configurations

No configuration.

History

19 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) El plugin smartctl de Zabbix Agent 2 no sanitiza correctamente los parámetros smart.disk.get, permitiendo a un atacante inyectar argumentos inesperados en el comando smartctl. En Zabbix 5.0 esto permite la ejecución remota de código.

Information

Published : 2025-09-12 11:15

Updated : 2026-10-19 17:10

NVD link : CVE-2025-27234

Mitre link : CVE-2025-27234

CVE.ORG link : CVE-2025-27234

JSON object : View

Products Affected

No product.

CWE

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

{"id": "CVE-2025-27234", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-27234", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "version": "2.0.3", "timestamp": "2025-09-13T03:55:35.156320Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security@zabbix.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 7.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "HIGH", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security@zabbix.com", "affectedData": [{"repo": "https://git.zabbix.com/", "vendor": "Zabbix", "modules": ["Agent2 plugin"], "product": "Zabbix", "versions": [{"status": "affected", "changes": [{"at": "5.0.47", "status": "unaffected"}], "version": "5.0.0", "versionType": "git", "lessThanOrEqual": "5.0.46"}], "defaultStatus": "unknown"}]}], "published": "2025-09-12T11:15:31.390", "references": [{"url": "https://support.zabbix.com/browse/ZBX-26985", "source": "security@zabbix.com"}, {"url": "https://lists.debian.org/debian-lts-announce/2026/02/msg00012.html", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security@zabbix.com", "description": [{"lang": "en", "value": "CWE-78"}]}], "descriptions": [{"lang": "en", "value": "Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution."}, {"lang": "es", "value": "El plugin smartctl de Zabbix Agent 2 no sanitiza correctamente los par\u00e1metros smart.disk.get, permitiendo a un atacante inyectar argumentos inesperados en el comando smartctl. En Zabbix 5.0 esto permite la ejecuci\u00f3n remota de c\u00f3digo."}], "lastModified": "2026-10-19T17:10:00.173", "sourceIdentifier": "security@zabbix.com"}