CVE-2025-27233 — Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.

CVE-2025-27233

Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later. PUBLISHED

Description (CNA)

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.

Affected (CNA)

Vendor / product	Versions
Zabbix / Zabbix	affected 6.0.0 through 6.0.39; affected 7.0.0 through 7.0.10; affected 7.2.0 through 7.2.4

CWE

CWE-77

References

https://support.zabbix.com/browse/ZBX-26987

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.