cbcvebase.
CVE-2023-32728
published 2023-12-18

CVE-2023-32728: The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote…

PriorityP358critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.75%
50.4th percentile
The Zabbix Agent 2 item key smart.disk.get does not sanitize its parameters before passing them to a shell command resulting possible vulnerability for remote code execution.

Affected

11 ranges
VendorProductVersion rangeFixed in
debianzabbix< zabbix 1:6.0.24+dfsg-1 (forky)zabbix 1:6.0.24+dfsg-1 (forky)
zabbixzabbix>= 0 < 1:6.0.24+dfsg-11:6.0.24+dfsg-1
zabbixzabbix>= 0 < 1:6.0.24+dfsg-11:6.0.24+dfsg-1
zabbixzabbix5,0,0 – 5.0.38—
zabbixzabbix6.0.0 – 6.0.23—
zabbixzabbix6.4.0 – 6.4.8 —
zabbixzabbix7.0.0alpha1 – 7.0.0alpha7 —
zabbixzabbix-agent2——
zabbixzabbix-agent25.0.0 – 5.0.38—
zabbixzabbix-agent26.0.0 – 6.0.23—
zabbixzabbix-agent26.4.0 – 6.4.8—

CVSS provenance

nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
osv9.8CRITICAL
vendor_debian4.6MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.