CVE-2024-22122

What it actually does

Lack of input validation on the SMS Number field allows an authenticated high-privileged user to inject arbitrary AT commands that are executed on a connected modem when an SMS test is triggered from the Zabbix server.

Why it matters to the business

Organizations relying on Zabbix SMS alerts face a narrow risk of modem misuse or disruption if an attacker already possesses administrative access; the issue has low exploitability and has not been observed in ransomware or widespread campaigns.

How an attack unfolds

An attacker with Zabbix administrator privileges crafts a malicious phone number containing additional AT command sequences, submits it through the web interface SMS test function, and the unvalidated payload is passed to the Zabbix server which forwards the extra commands to the modem.

How to fix it

Upgrade affected Zabbix components to versions that enforce validation on the Number field; apply the corresponding fixed packages for any dependent modules such as nodejs-nodemon 1.18.3-1.module_el8.3.0+2023+d2377ea3 or nodejs-packaging 17-3.module_el8.4.0+2224+b07ac28e where applicable.

How to confirm the fix worked

Confirm the Number field now rejects or sanitizes AT command sequences during SMS tests; review Zabbix server logs for any prior test operations that contained unexpected AT command strings.

Typical attack path

1. Obtain Zabbix administrator credentials
2. Navigate to Administration > Media types > SMS
3. Enter a specially crafted value in the Number field
4. Trigger the SMS test operation
5. Observe or confirm execution of injected AT commands on the modem

How to detect it

Search Zabbix server and web logs for SMS test requests containing AT command prefixes such as AT+ or unusual characters in the recipient number field; inspect modem serial logs for unexpected command sequences after test operations.

What your security team should do

• Prioritize patching Zabbix instances that use SMS notifications
• Restrict SMS test functionality to the minimum required administrators
• Monitor modem logs for unexpected AT command activity
• Review and tighten input validation on all notification configuration fields