CVE-2024-36468
Stack buffer overflow in zbx_snmp_cache_handle_engineid
Severity Score
3.0
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track
*SSVC
Descriptions
The reported vulnerability is a stack buffer overflow in the zbx_snmp_cache_handle_engineid function within the Zabbix server/proxy code. This issue occurs when copying data from session->securityEngineID to local_record.engineid without proper bounds checking.
La vulnerabilidad informada es un desbordamiento del búfer de pila en la función zbx_snmp_cache_handle_engineid dentro del código del servidor/proxy Zabbix. Este problema ocurre al copiar datos de session->securityEngineID a local_record.engineid sin la verificación de los límites adecuada.
*Credits:
Zabbix wants to thank chamal for submitting this report on the HackerOne bug bounty platform
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-05-28 CVE Reserved
- 2024-11-27 CVE Published
- 2024-11-27 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-121: Stack-based Buffer Overflow
CAPEC
- CAPEC-100: Overflow Buffers