CVE-2024-36468

HIGH EPSS 39.0%

Published Nov 27, 20241y ago · Modified Jun 17, 20261w ago

8.2 CVSS 3.1

High

Published Nov 27, 2024 1y ago

Last Modified Jun 17, 2026 1w ago

Description

The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityEngineID to local_record.engineid without proper bounds checking.

CVSS Details

Base Score

8.2

Exploitability

3.9

Impact

4.2

Vector string

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H

Attack Vector Network

Attack Complexity Low

Privileges Required None

User Interaction None

Scope Unchanged

Confidentiality Low

Integrity None

Availability High

Threat Intelligence

EPSS Exploit Probability

39.0% percentile

Exploit & Patch Status

No Known Exploit

No Patch Available

Weaknesses 1

CWE-121

Affected Products 1

Vendor	Product	Version	Range
zabbix	zabbix	*	≥7.0.0 – <7.0.3

References 1

support.zabbix.com https://support.zabbix.com/browse/ZBX-25621

Vendor Advisory

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.