Vulnerability Details : CVE-2009-4502

Public exploit exists!
The NET_TCP_LISTEN function in net.c in Zabbix Agent before 1.6.7, when running on FreeBSD or Solaris, allows remote attackers to bypass the EnableRemoteCommands setting and execute arbitrary commands via shell metacharacters in the argument to net.tcp.listen. NOTE: this attack is limited to attacks from trusted IP addresses.
Published 2009-12-31 18:30:02
Updated 2025-04-09 00:30:58
Source MITRE
View at NVD,   CVE.org

Products affected by CVE-2009-4502

Exploit prediction scoring system (EPSS) score for CVE-2009-4502

EPSS FAQ
63.55%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 98 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2009-4502

  • Zabbix Agent net.tcp.listen Command Injection
    Disclosure Date: 2009-09-10
    First seen: 2020-04-26
    exploit/unix/misc/zabbix_agent_exec
    This module exploits a metacharacter injection vulnerability in the FreeBSD and Solaris versions of the Zabbix agent. This flaw can only be exploited if the attacker can hijack the IP address of an authorized server (as defined in the configuration file). Au

CVSS scores for CVE-2009-4502

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
9.3
 HIGH AV:N/AC:M/Au:N/C:C/I:C/A:C
8.6
10.0
 NIST

CWE ids for CVE-2009-4502

  • Assigned by: nvd@nist.gov (Primary)

References for CVE-2009-4502

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close