CVE-2025-27233 — Zabbix Agent 2 smartctl plugin argument injection in Zabbix 6.0 and later.
Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be u…
Published: 2025-09-12 · CVSS: 5.7 · CVSS 4.0
Zabbix Agent 2 smartctl plugin does not properly sanitize smart.disk.get parameters, allowing an attacker to inject unexpected arguments into the smartctl command. This can be used to leak the NTLMv2 hash from a Windows system.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7