CVE-2025-27234

HIGH

Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.

Title source: CVE List
STIX 2.1 vulnerability

Record summary

CVE-2025-27234 has a selected CVSS score of 7.3 (high).

Description

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.

Description source: CVE List

Exploitation context

CISA SSVC decision

ExploitationNone
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Sep 13, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Zabbix

Browse Zabbix / Zabbix

Default status: unknown

CVE List5.0.0 to ≤ 5.0.46affected

References

3