What’s Vulnerable › Vulnerabilities

CVE-2023-32727: Code execution vulnerability in icmpping

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.9% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2023-12-18 · updated 2026-06-17
• Weakness: CWE-20

Description

An attacker who has the privilege to configure Zabbix items can use function icmpping() with additional malicious command inside it to execute arbitrary code on the current Zabbix server.

Affected products

• Zabbix Server: from 4.0.0 through 4.0.49; from 5.0.0 through 5.0.38; from 6.0.0 through 6.0.22; from 6.4.0 through 6.4.7; 7.0.0-alpha1, 7.0.0-alpha2, 7.0.0-alpha3, 7.0.0-alpha6

References

• https://support.zabbix.com/browse/ZBX-23857
• https://lists.debian.org/debian-lts-announce/2024/10/msg00000.html
• https://support.zabbix.com/browse/ZBX-23857

Get alerted when CVE-2023-32727 or the next vulnerability affects your stack