PT-2024-6089 · Zabbix+2 · Zabbix Agent+3

Gee-Netics + 1 · Published 2024-08-09 · Updated 2024-12-10 · CVE-2024-22121

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L

Name of the Vulnerable Software and Affected Versions Zabbix Agent versions prior to 7.0.0rc2

Description The issue is related to improper permission storage in the Zabbix Agent application. This can allow an attacker to elevate their privileges. A non-admin user can change or remove important features within the application, thus impacting its integrity and availability.

Recommendations For versions prior to 7.0.0rc2, upgrade the affected components immediately to mitigate the risk. As a temporary workaround, consider restricting access to sensitive features within the Zabbix Agent application to prevent unauthorized changes.

Exploit

Fix

Improper Preservation of Permissions

Weakness Enumeration

CWE-281

Related Identifiers

ALT-PU-2024-11571

ALT-PU-2024-11575

ALT-PU-2024-15832

BDU:2024-06995

CVE-2024-22121

Affected Products

Alt Linux

Red Os

Zabbix

Zabbix Agent

References · 19

• 🔥 https://github.com/W01fh4cker/CVE-2024-22120-RCE · Exploit
• 🔥 https://github.com/g4nkd/CVE-2024-22120-RCE-with-gopher · Exploit
• 🔥 https://github.com/isPique/CVE-2024-22120-RCE-with-gopher · Exploit
• https://ubuntu.com/security/CVE-2024-22121 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-06995 · Security Note
• https://support.zabbix.com/browse/ZBX-25011 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-22121 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-22121 · Security Note
• https://cve.org/CVERecord?id=CVE-2024-22121 · Security Note
• https://osv.dev/vulnerability/CVE-2024-22121 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-22121 · Vendor Advisory
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-zabbix-10-09-24 · Note
• https://abf.rosa.ru/advisories/ROSA-SA-2025-2773 · Note
• https://twitter.com/VulmonFeeds/status/1823009774427853124 · Twitter Post