CVE-2024-42332

What it actually does

Improper parsing of SNMP trap logs allows injection of additional lines containing forged data that is then displayed in the Zabbix UI; the flaw is triggered only when SNMP authentication is disabled or credentials are known and when an SNMP item is configured to collect text data.

Why it matters to the business

Attackers can cause misleading or fabricated monitoring data to appear in dashboards, potentially leading to incorrect operational decisions or confusion during incident response; the issue is limited to environments with specific SNMP item configurations and weak authentication.

How an attack unfolds

An attacker who can reach the target host crafts an SNMP trap containing extra lines of fabricated information, sends the trap using known or absent community strings, and the Zabbix server parses the log entry so that the forged content is rendered in the user interface.

How to fix it

Upgrade Zabbix to the commit d93ce022627d3f10608b774e322cde3c961453e3 or later; enable SNMP authentication where possible and restrict text-type SNMP items to trusted sources.

How to confirm the fix worked

Verify the running version contains commit d93ce022627d3f10608b774e322cde3c961453e3; attempt to replay a crafted multi-line SNMP trap and confirm that extra lines no longer appear in the UI.

Typical attack path

1. Obtain or bypass SNMP authentication credentials
2. Ensure or configure an SNMP item of type text on the monitored host
3. Craft and transmit a malicious SNMP trap containing additional forged lines
4. Observe the injected data appearing in the Zabbix UI

How to detect it

Inspect SNMP trap logs and Zabbix server logs for entries containing unexpected line breaks or anomalous text patterns that do not match expected trap formats.

What your security team should do

• Apply the fixed commit immediately on all Zabbix instances
• Audit and enforce SNMP authentication settings across the environment
• Review all SNMP items configured as text and restrict their use
• Monitor for unexpected changes in trap-derived data