CVE-2024-22120: Zabbix Server Audit Log clientip SQL Injection Enables Command Execution

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityHigh CVSS (8.8), very high EPSS and a vendor advisory tagged Exploit make this a likely target, though it requires low privileges and is not in KEV.

What it is

Zabbix server fails to sanitize the clientip field before writing it to the audit log, allowing SQL injection into that field. Because the server can execute configured scripts, an attacker who can trigger an audit entry can chain the SQL injection into command execution. The flaw is a time-based blind SQL injection, so exploitation is possible without seeing query output.

Impact

An attacker gains the ability to run commands through Zabbix's configured script execution and can read or alter database contents via blind SQL injection. CVSS 3.1 rates confidentiality, integrity and availability impact as high.

Attack surface

Reached over the network (AV:N) with low attack complexity and no user interaction. The vector requires low privileges (PR:L), so the attacker needs some authenticated access to the Zabbix server rather than being fully unauthenticated.

Exploitation

Not listed in CISA KEV, but EPSS is 0.76618 (99.5th percentile) and the vendor advisory is tagged Exploit, indicating public exploit material exists and exploitation is likely.

What to do

• Apply the Zabbix fix referenced in vendor advisory ZBX-24505 for the affected server version.
• Restrict network access to the Zabbix server and frontend to trusted management networks.
• Review and minimize accounts with privileges that can trigger script execution or audit log writes.
• Audit configured Zabbix scripts and disable any that are not required.
• Monitor Zabbix audit logs and database query behavior for anomalous clientip values.

Detection

• Inspect Zabbix audit log entries for clientip values containing SQL syntax, quotes, or time-delay functions.
• Alert on unusually long or repeated database queries originating from the Zabbix server process.
• Monitor for unexpected command execution spawned by the Zabbix server process.
• Correlate Zabbix audit log writes with subsequent script execution events.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.