CVE-2025-27233
BaseFortify
Publication date: 2025-09-12
Last updated on: 2025-09-15
Assigner: Zabbix
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| zabbix | zabbix_agent | 4.0 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-77 | The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
The vulnerability in Zabbix Agent 2's smartctl plugin arises because it does not properly sanitize the parameters passed to the smart.disk.get function. This flaw allows an attacker to inject unexpected arguments into the smartctl command, potentially leading to unauthorized actions such as leaking sensitive information like the NTLMv2 hash from a Windows system.
How can this vulnerability impact me? :
This vulnerability can impact you by allowing an attacker to extract sensitive authentication data, specifically the NTLMv2 hash, from your Windows system. Such a leak can facilitate further attacks like credential theft or unauthorized access, compromising system security and user data.