CVE-2024-22122CWE-77

AT(GSM) Command Injection

Low · published August 9, 2024

CVSS v3.1
3.0
EPSS
2%
Percentile
75.7
In the wild
Unconfirmed
What it is

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.

The record
Technical detail
CVSS v3.1
3.0 · LOW
Vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01606 · 75.7th percentile
Weakness
CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
Published
2024-08-09T08:46Z
EPSS history
Timeline
  • 09 AUG 08:46Z
    AT(GSM) Command Injection
    cvelistv5