CVE-2025-27234CWE-78command-injection

CVE-2025-27234

published September 12, 2025

CVSS

7.3

EPSS

Percentile

22.9

In the wild

Unconfirmed

What it is

Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. In Zabbix 5.0 this allows for remote code execution.

The record

Technical detail

CVSS: 7.3 · NONE
CVSS v4.0: Not supplied
EPSS: 0.00312 · 22.9th percentile
Weakness: CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Published: 2025-09-12T15:15Z

References (2)

https://support.zabbix.com/browse/ZBX-26985 · [email protected]https://lists.debian.org/debian-lts-announce/2026/02/msg00012.html · af854a3a-2127-422b-91ae-364da2661108

EPSS history

Timeline

12 SEP 10:31Z
Zabbix Agent 2 smartctl plugin RCE vulnerability in Zabbix 5.0.
cvelistv5