VYPR
← All advisories
Low severity3.0NVD Advisory· Published Aug 12, 2024· Updated Jun 17, 2026

CVE-2024-22122

CVE-2024-22122

Description

Zabbix allows to configure SMS notifications. AT command injection occurs on "Zabbix Server" because there is no validation of "Number" field on Web nor on Zabbix server side. Attacker can run test of SMS providing specially crafted phone number and execute additional AT commands on modem.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

17
  • Zabbix/Zabbixv516 versions
    5.0.0+ 15 more
    • (no CPE)range: 5.0.0
    • cpe:2.3:a:zabbix:zabbix:*:*:*:*:*:*:*:*range: >=5.0.0,<=5.0.42
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha1:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha2:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha3:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha4:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha5:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha6:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha7:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha8:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:alpha9:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:beta1:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:beta2:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:beta3:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:rc1:*:*:*:*:*:*
    • cpe:2.3:a:zabbix:zabbix:7.0.0:rc2:*:*:*:*:*:*
  • Zabbix/Zabbix server/proxyllm-fuzzy

Patches

Vulnerability mechanics

References

2

News mentions

0

No linked articles in our index yet.