CVE-2024-22122 is an AT command injection vulnerability in Zabbix Server's SMS notification feature. The vulnerability arises because the 'Number' field used to configure SMS notifications is not validated on either the web interface or the server side. An attacker with appropriate privileges can supply a specially crafted phone number to execute arbitrary AT commands on the modem. This flaw has a low CVSS score of 3.1 and requires high privileges and network access to exploit.