CVE-2024-22116criticalCWE-94

CVE-2024-22116: critical vulnerability in Zabbix

Remote code execution within ping script

Published · Updated

Follow this CVE+ Monitor Zabbix+ Monitor zabbix

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

28Vexday Risk Score

No sign of exploitation. It has an official Brazilian government alert.

ssvc Trackcvss 9.9epss 1.6%
Official alert in Brazil

Brazil's federal government published an alert, recommendation or bulletin that cites this vulnerability.

Source: CTIR Gov (GSI) and CISC Gov.br, under the CC BY-ND 3.0 license.
An administrator with restricted permissions can exploit the script execution functionality within the Monitoring Hosts section. The lack of default escaping for script parameters enabled this user ability to execute arbitrary code via the Ping script, thereby compromising infrastructure.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected products
Zabbix · Zabbix
Related CVEs — Zabbix

In the same product, most dangerous first.

CVE-2024-42327CRITICALSQL injection in user.get APIEPSS 79.1%CVE-2024-22120CRITICALTime Based SQL Injection in Zabbix Server Audit LogEPSS 76.6%CVE-2013-3628—CVE-2013-3628EPSS 67.5%CVE-2023-29452MEDIUMRemove possibility to add html into Geomap attribution fieldEPSS 64.1%CVE-2024-36465HIGHSQL injection in Zabbix APIEPSS 39.9%CVE-2026-23921HIGHBlind, read-only SQL injection in Zabbix API via sortfield parameterEPSS 4.1%