PT-2025-37304 · Zabbix+4 · Zabbix Agent 2+4

Janis Nulle · Published 2025-01-01 · Updated 2026-02-08 · CVE-2025-27234

Positive Technologies (AI Summary)

CVSS v2.0

7.7

High

Base vector

AV:A/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: Zabbix Agent 2 versions 5.0 and earlier

Description: The Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, potentially allowing an attacker to inject unexpected arguments into the smartctl command. This can lead to remote code execution.

Recommendations: Update Zabbix Agent 2 to a version later than 5.0.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

ALT-PU-2025-12637

BDU:2025-12724

CVE-2025-27234

Affected Products

Alt Linux

Astra Linux

Debian

Zabbix Agent 2

Smartctl

References · 16

• https://security-tracker.debian.org/tracker/CVE-2025-27234 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-27234 · Security Note
• https://ubuntu.com/security/CVE-2025-27234 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-27234 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-27234 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-12724 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-27234 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-27234 · Vendor Advisory
• https://t.me/CVEtracker/32366 · Telegram Post
• https://t.me/cveNotify/151309 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1966477798802915330 · Twitter Post
• https://lists.debian.org/debian-lts-announce/2026/02/msg00012.html · Note
• https://support.zabbix.com/browse/ZBX-26985 · Note
• https://t.me/cveNotify/135224 · Telegram Post
• https://twitter.com/Cezar_H_Linux/status/2020572323951120878 · Twitter Post