CVE-2012-10048
Zenoss 3.x showDaemonXMLConfig Command Execution
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
Zenoss Core 3.x contains a command injection vulnerability in the showDaemonXMLConfig endpoint. The daemon parameter is passed directly to a Popen() call in ZenossInfo.py without proper sanitation, allowing authenticated users to execute arbitrary commands on the server as the zenoss user.
| CWE | CWE-22 |
| Vendor | zenoss, inc. |
| Product | zenoss core |
| Published | Aug 8, 2025 |
| Last Updated | Apr 7, 2026 |
Stay Ahead of the Next One
Get instant alerts for zenoss, inc. zenoss core
Be the first to know when new unknown vulnerabilities affecting zenoss, inc. zenoss core are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Zenoss, Inc. / Zenoss Core
3.0
References
exploit-db.com: https://www.exploit-db.com/exploits/20205 raw.githubusercontent.com: https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/zenoss_showdaemonxmlconfig_exec.rb exploit-db.com: https://www.exploit-db.com/exploits/37571 web.archive.org: http://web.archive.org/web/20221203180334/https://itsecuritysolutions.org/2012-07-30-zenoss-3.2.1-multiple-security-vulnerabilities/ sourceforge.net: https://sourceforge.net/projects/zenoss/ vulncheck.com: https://www.vulncheck.com/advisories/zenoss-command-execution
Credits
bcoles