The vulnerability in Zabbix CLI involves the use of AnyIO's connect_tcp() or TLSStream.wrap() functions for TLS connections to internationalized (non-ASCII) domain names. Due to the use of IDNA 2003 encoding, an attacker who hijacks and redirects the connection to a malicious server can obtain a legitimate TLS certificate for the IDNA 2003 encoded domain. This certificate would validate correctly on the client side, enabling potential TLS certificate spoofing. The vulnerability affects versions 3.0.0 and later and is scheduled to be patched in version 4.14.2. Until then, encoding host names with the 'idna' package before connecting serves as a mitigation.

An attacker capable of hijacking and redirecting TLS connections to internationalized domain names can present a malicious server with a legitimate TLS certificate encoded using IDNA 2003. This causes the client to accept the certificate as valid, potentially enabling man-in-the-middle attacks or interception of sensitive data over TLS connections.

The vulnerability will be addressed in Zabbix CLI version 4.14.2. Until the patch is applied, users should encode host names using the 'idna' package prior to making TLS connections to internationalized domain names. No other vendor advisories indicate alternative mitigations or that no action is required.