CVE-2025-27233 - Vulnerability Details - OpenCVE

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required High

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Exploitation none

Automatable no

Technical Impact partial

No data.

No data.

No data.

No data.

Fixes

Solution

Update the affected components to their respective fixed versions.

Workaround

Remove smartctl or use strict item key parameter validation with AllowKey/DenyKey.

References

Link	Providers
https://support.zabbix.com/browse/ZBX-26987

History

Fri, 12 Sep 2025 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 12 Sep 2025 10:45:00 +0000

Type	Values Removed	Values Added
Description		Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.
Title		Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.
Weaknesses		CWE-77
References		https://support.zabbix.com/browse/ZBX-26987
Metrics		cvssV4_0 `{'score': 5.7, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Zabbix

Published: 2025-09-12T10:32:36.174Z

Updated: 2025-09-12T11:58:28.618Z

Reserved: 2025-02-20T11:40:38.480Z

Link: CVE-2025-27233

Vulnrichment

Updated: 2025-09-12T11:58:23.631Z

NVD

Status : Received

Published: 2025-09-12T11:15:31.237

Modified: 2025-09-12T11:15:31.237

Link: CVE-2025-27233

Redhat

No data.

OpenCVE Enrichment

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27233", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "state": "PUBLISHED", "assignerShortName": "Zabbix", "dateReserved": "2025-02-20T11:40:38.480Z", "datePublished": "2025-09-12T10:32:36.174Z", "dateUpdated": "2025-09-12T11:58:28.618Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["Agent2 plugin"], "product": "Zabbix", "repo": "https://git.zabbix.com/", "vendor": "Zabbix", "versions": [{"changes": [{"at": "6.0.40", "status": "unaffected"}], "lessThanOrEqual": "6.0.39", "status": "affected", "version": "6.0.0", "versionType": "git"}, {"changes": [{"at": "7.0.11", "status": "unaffected"}], "lessThanOrEqual": "7.0.10", "status": "affected", "version": "7.0.0", "versionType": "git"}, {"changes": [{"at": "7.2.5", "status": "unaffected"}], "lessThanOrEqual": "7.2.4", "status": "affected", "version": "7.2.0", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric.</p>"}], "value": "An attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric."}], "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank kelsier for submitting this report on the HackerOne bug bounty platform."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.</p>"}], "value": "Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system."}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88: OS Command Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "baseScore": 5.7, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2025-09-12T10:32:36.174Z"}, "references": [{"url": "https://support.zabbix.com/browse/ZBX-26987"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update the affected components to their respective fixed versions.</p>"}], "value": "Update the affected components to their respective fixed versions."}], "source": {"discovery": "EXTERNAL"}, "title": "Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Remove smartctl or use strict item key parameter validation with AllowKey/DenyKey.</p>"}], "value": "Remove smartctl or use strict item key parameter validation with AllowKey/DenyKey."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-12T11:57:58.701448Z", "id": "CVE-2025-27233", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T11:58:28.618Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-27233", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-12T11:57:58.701448Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T11:58:23.631Z"}}], "cna": {"title": "Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank kelsier for submitting this report on the HackerOne bug bounty platform."}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88: OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.zabbix.com/", "vendor": "Zabbix", "modules": ["Agent2 plugin"], "product": "Zabbix", "versions": [{"status": "affected", "changes": [{"at": "6.0.40", "status": "unaffected"}], "version": "6.0.0", "versionType": "git", "lessThanOrEqual": "6.0.39"}, {"status": "affected", "changes": [{"at": "7.0.11", "status": "unaffected"}], "version": "7.0.0", "versionType": "git", "lessThanOrEqual": "7.0.10"}, {"status": "affected", "changes": [{"at": "7.2.5", "status": "unaffected"}], "version": "7.2.0", "versionType": "git", "lessThanOrEqual": "7.2.4"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Update the affected components to their respective fixed versions.", "supportingMedia": [{"type": "text/html", "value": "<p>Update the affected components to their respective fixed versions.</p>", "base64": false}]}], "references": [{"url": "https://support.zabbix.com/browse/ZBX-26987"}], "workarounds": [{"lang": "en", "value": "Remove smartctl or use strict item key parameter validation with AllowKey/DenyKey.", "supportingMedia": [{"type": "text/html", "value": "<p>Remove smartctl or use strict item key parameter validation with AllowKey/DenyKey.</p>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.", "supportingMedia": [{"type": "text/html", "value": "<p>Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "configurations": [{"lang": "en", "value": "An attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric.", "supportingMedia": [{"type": "text/html", "value": "<p>An attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric.</p>", "base64": false}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2025-09-12T10:32:36.174Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27233", "state": "PUBLISHED", "dateUpdated": "2025-09-12T11:58:28.618Z", "dateReserved": "2025-02-20T11:40:38.480Z", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "datePublished": "2025-09-12T10:32:36.174Z", "assignerShortName": "Zabbix"}, "dataVersion": "5.1"}