CVE-2017-2824

Severity: high (CVSS 8.1 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 26.1% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-05-24 · updated 2026-06-17
Weakness: CWE-78

Description

An exploitable code execution vulnerability exists in the trapper command functionality of Zabbix Server 2.4.X. A specially crafted set of packets can cause a command injection resulting in remote code execution. An attacker can make requests from an active Zabbix Proxy to trigger this vulnerability.

Affected products

Zabbix: 2.4.0, 2.4.0-rc1, 2.4.0-rc2, 2.4.0-rc3, 2.4.1, 2.4.1-rc1 (+17)

References

http://www.debian.org/security/2017/dsa-3937
http://www.securityfocus.com/bid/98083
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0325
http://www.debian.org/security/2017/dsa-3937
http://www.securityfocus.com/bid/98083
https://talosintelligence.com/vulnerability_reports/TALOS-2017-0325

Get alerted when CVE-2017-2824 or the next vulnerability affects your stack