CVE-2025-27233 - Vulnerability Details - OpenCVE

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.

Attack Vector Adjacent Network

Attack Complexity High

Privileges Required High

Attack Requirements Present

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact None

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Microsoft	Windows
Zabbix	Zabbix Zabbix-agent Zabbix-agent2

No data.

No data.

References

Link	Providers
https://support.zabbix.com/browse/ZBX-26987

History

Mon, 15 Sep 2025 10:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Microsoft Microsoft windows Zabbix Zabbix zabbix Zabbix zabbix-agent Zabbix zabbix-agent2
Vendors & Products		Microsoft Microsoft windows Zabbix Zabbix zabbix Zabbix zabbix-agent Zabbix zabbix-agent2

Fri, 12 Sep 2025 12:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Fri, 12 Sep 2025 10:45:00 +0000

Type	Values Removed	Values Added
Description		Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.
Title		Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.
Weaknesses		CWE-77
References		https://support.zabbix.com/browse/ZBX-26987
Metrics		cvssV4_0 `{'score': 5.7, 'vector': 'CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N'}`

MITRE

Status: PUBLISHED

Assigner: Zabbix

Published: 2025-09-12T10:32:36.174Z

Updated: 2025-09-12T11:58:28.618Z

Reserved: 2025-02-20T11:40:38.480Z

Link: CVE-2025-27233

Vulnrichment

Updated: 2025-09-12T11:58:23.631Z

NVD

Status : Awaiting Analysis

Published: 2025-09-12T11:15:31.237

Modified: 2025-09-15T15:21:42.937

Link: CVE-2025-27233

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-27233", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "state": "PUBLISHED", "assignerShortName": "Zabbix", "dateReserved": "2025-02-20T11:40:38.480Z", "datePublished": "2025-09-12T10:32:36.174Z", "dateUpdated": "2025-09-12T11:58:28.618Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unknown", "modules": ["Agent2 plugin"], "product": "Zabbix", "repo": "https://git.zabbix.com/", "vendor": "Zabbix", "versions": [{"changes": [{"at": "6.0.40", "status": "unaffected"}], "lessThanOrEqual": "6.0.39", "status": "affected", "version": "6.0.0", "versionType": "git"}, {"changes": [{"at": "7.0.11", "status": "unaffected"}], "lessThanOrEqual": "7.0.10", "status": "affected", "version": "7.0.0", "versionType": "git"}, {"changes": [{"at": "7.2.5", "status": "unaffected"}], "lessThanOrEqual": "7.2.4", "status": "affected", "version": "7.2.0", "versionType": "git"}]}], "configurations": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>An attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric.</p>"}], "value": "An attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric."}], "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank kelsier for submitting this report on the HackerOne bug bounty platform."}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.</p>"}], "value": "Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system."}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88: OS Command Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "attackVector": "ADJACENT", "baseScore": 5.7, "baseSeverity": "MEDIUM", "privilegesRequired": "HIGH", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2025-09-12T10:32:36.174Z"}, "references": [{"url": "https://support.zabbix.com/browse/ZBX-26987"}], "solutions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Update the affected components to their respective fixed versions.</p>"}], "value": "Update the affected components to their respective fixed versions."}], "source": {"discovery": "EXTERNAL"}, "title": "Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.", "workarounds": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "<p>Remove smartctl or use strict item key parameter validation with AllowKey/DenyKey.</p>"}], "value": "Remove smartctl or use strict item key parameter validation with AllowKey/DenyKey."}], "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-12T11:57:58.701448Z", "id": "CVE-2025-27233", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T11:58:28.618Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-27233", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-12T11:57:58.701448Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-12T11:58:23.631Z"}}], "cna": {"title": "Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.", "source": {"discovery": "EXTERNAL"}, "credits": [{"lang": "en", "type": "reporter", "value": "Zabbix wants to thank kelsier for submitting this report on the HackerOne bug bounty platform."}], "impacts": [{"capecId": "CAPEC-88", "descriptions": [{"lang": "en", "value": "CAPEC-88: OS Command Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 5.7, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:H/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "PRESENT", "privilegesRequired": "HIGH", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://git.zabbix.com/", "vendor": "Zabbix", "modules": ["Agent2 plugin"], "product": "Zabbix", "versions": [{"status": "affected", "changes": [{"at": "6.0.40", "status": "unaffected"}], "version": "6.0.0", "versionType": "git", "lessThanOrEqual": "6.0.39"}, {"status": "affected", "changes": [{"at": "7.0.11", "status": "unaffected"}], "version": "7.0.0", "versionType": "git", "lessThanOrEqual": "7.0.10"}, {"status": "affected", "changes": [{"at": "7.2.5", "status": "unaffected"}], "version": "7.2.0", "versionType": "git", "lessThanOrEqual": "7.2.4"}], "defaultStatus": "unknown"}], "solutions": [{"lang": "en", "value": "Update the affected components to their respective fixed versions.", "supportingMedia": [{"type": "text/html", "value": "<p>Update the affected components to their respective fixed versions.</p>", "base64": false}]}], "references": [{"url": "https://support.zabbix.com/browse/ZBX-26987"}], "workarounds": [{"lang": "en", "value": "Remove smartctl or use strict item key parameter validation with AllowKey/DenyKey.", "supportingMedia": [{"type": "text/html", "value": "<p>Remove smartctl or use strict item key parameter validation with AllowKey/DenyKey.</p>", "base64": false}]}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.", "supportingMedia": [{"type": "text/html", "value": "<p>Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-77", "description": "CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')"}]}], "configurations": [{"lang": "en", "value": "An attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric.", "supportingMedia": [{"type": "text/html", "value": "<p>An attacker could request Agent 2 to monitor a metric with malicious arguments in the smart.disk.get metric.</p>", "base64": false}]}], "providerMetadata": {"orgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "shortName": "Zabbix", "dateUpdated": "2025-09-12T10:32:36.174Z"}}}, "cveMetadata": {"cveId": "CVE-2025-27233", "state": "PUBLISHED", "dateUpdated": "2025-09-12T11:58:28.618Z", "dateReserved": "2025-02-20T11:40:38.480Z", "assignerOrgId": "72de3e22-0555-4a0d-ae81-9249e0f0a1e8", "datePublished": "2025-09-12T10:32:36.174Z", "assignerShortName": "Zabbix"}, "dataVersion": "5.1"}