CVE-2024-22122 — AT(GSM) Command Injection

CVE-2024-22122

AT(GSM) Command Injection PUBLISHED

Description (CNA)

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 5.0.0 through 5.0.42; affected 6.0.0 through 6.0.30; affected 6.4.0 through 6.4.15; affected 7.0.0alpha1 through 7.0.0rc2

CWE

CWE-77

References

https://support.zabbix.com/browse/ZBX-25012

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.

CVE

No English description supplied.

https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html