CVE-2024-22122 AT(GSM) Command Injection
Attackers can inject AT commands via crafted phone numbers in SMS tests, potentially executing commands on the connected modem.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-22122?
CVE-2024-22122 is a low-severity command injection vulnerability in Zabbix Zabbix, published on 9 Aug 2024. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.
Weakness: CWE-77
Which versions are affected by CVE-2024-22122?
It affects 1 product.
Products include Zabbix Zabbix.
How do I fix CVE-2024-22122?
Apply the vendor's patch.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2024-22122 being exploited?
There is no known exploitation of CVE-2024-22122 in the wild and no public exploit code.
Other vulnerabilities in Zabbix Zabbix
Sources
Also known as DEBIAN-CVE-2024-22122, GHSA-m34r-jrv8-mwmv, UBUNTU-CVE-2024-22122.