CVE-2025-27233CWE-77command-injection
CVE-2025-27233
published September 12, 2025
What it is
Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.
The record
Technical detail
- CVSS
- 5.7 · NONE
- CVSS v4.0
- Not supplied
- EPSS
- 0.00170 · 6.0th percentile
- Weakness
- CWE-77 · Improper Neutralization of Special Elements used in a Command ('Command Injection')
- Published
- 2025-09-12T15:15Z
References (1)
EPSS history
Timeline