Checkmk CVE-2025-39666

The CVSS 9.3 score accurately reflects the severe technical impact-complete system compromise (VC:H/VI:H/VA:H with scope change SC:H/SI:H/SA:H)-but several factors moderate real-world risk. The attack vector is local-only (AV:L) and requires high privileges (PR:H), meaning the attacker must already possess site user credentials, which typically involves authenticated access to the Checkmk administrative interface. SSVC framework confirms exploitation is not automatable and requires specific preconditions. No public exploit code exists and no CISA KEV listing indicates active exploitation campaigns. However, low attack complexity (AC:L) means the technique is straightforward once access is obtained. This is a genuine security boundary violation requiring patching, but not an imminent mass-exploitation threat. Organizations should prioritize based on: (1) whether untrusted users have site-level access, (2) lateral movement risk if web-tier credentials are compromised, and (3) compliance requirements around privilege separation. The 2.2.0 branch is end-of-life, increasing risk for unpatched legacy installations.

An attacker who has compromised credentials for a Checkmk site user-either through phishing, credential reuse, or exploitation of a separate web application vulnerability-logs into the monitoring instance with site administrative privileges. The attacker navigates to the site's file system context and creates or modifies configuration files, shell scripts, or plugin components that the 'omd' management utility will process. When a legitimate system administrator executes 'omd' commands with root privileges for routine maintenance tasks such as site updates, restarts, or configuration changes, the utility processes the attacker-controlled files without validation. This triggers execution of embedded malicious code with root privileges, granting the attacker full system control including the ability to install backdoors, access sensitive data across all monitoring instances, or pivot to monitored infrastructure using stored credentials.