Zenoss 3.x showDaemonXMLConfig Command Execution
Priority HIGH 73CWE-22Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA.
Summary
Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen() call in ZenossInfo.py without proper sanitation, allowing authenticated users to execute arbitrary commands on the server as the zenoss user.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.03673 89th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by the CNA
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2012-10048
- 2026-10-03 Alias added: GHSA-r65h-f3rc-mqmw
References
Exploit 4
- https://www.exploit-db.com/exploits/20205
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb
- https://www.exploit-db.com/exploits/37571
- http://web.archive.org/web/20221203180334/https://itsecuritysolutions.org/2012-07-30-zenoss-3.2.1-multiple-security-vulnerabilities/
More Zenoss vulnerabilities
- TI-2014-05152 Zenoss Core through 5 Beta 3 does not properly implement the Check For Updates feature… CVSS 2.0HIGH 9.3
- TI-2014-05153 Multiple format string vulnerabilities in the python module in RRDtool, as used in Zenoss… CVSS 3.1HIGH 7.5
- TI-2019-10617 The XML-RPC subsystem in Zenoss 2.5.3 allows XXE attacks that lead to unauthenticated… CVSS 3.0HIGH 7.5
- TI-2014-07508 The default configuration of Zenoss Core before 5 allows remote attackers to read or… CVSS 2.0HIGH 7.5
- TI-2014-05147 Zenoss Core through 5 Beta 3 allows remote attackers to bypass intended access… CVSS 2.0HIGH 7.5
- TI-2019-10616 pyraw in Zenoss 2.5.3 allows local privilege escalation by modifying environment… CVSS 3.0HIGH 7.8
Sources
- CVE-2012-10048 · CVE Program
- CVE-2012-10048 · NVD
- FIRST EPSS
- GHSA-r65h-f3rc-mqmw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences