CVE-2025-27234

HIGH

Zabbix Agent 2 - Remote Code Execution

Title source: llm
STIX 2.1

Description

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.

References (2)

Core 2

Scores

CVSS v4 7.3
EPSS 0.0029
EPSS Percentile 20.8%
CVSS:4.0/AV:A/AC:L/AT:P/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-78
Status published
Products (1)
Zabbix/Zabbix 5.0.0 - 5.0.46
Published Sep 12, 2025
Tracked Since Feb 18, 2026