EUVD-2025-209262CVSS Vector
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
3Description
Local privilege escalation in Checkmk 2.2.0 (EOL), Checkmk 2.3.0 before 2.3.0p46, Checkmk 2.4.0 before 2.4.0p25, and Checkmk 2.5.0 (beta) before 2.5.0b3 allows a site user to escalate their privileges to root, by manipulating files in the site context that are processed when the `omd` administrative command is run by root.
Analysis
Local privilege escalation in Checkmk allows site users with high privileges to escalate to root by manipulating site context files processed by the root-executed 'omd' administrative command. Affects Checkmk 2.2.0 (EOL), 2.3.0 before p46, 2.4.0 before p25, and 2.5.0 beta before b3. No public exploit identified at time of analysis. CVSS 9.3 reflects total technical impact, but SSVC assessment indicates non-automatable exploitation requiring existing high-privilege access, tempering the real-world urgency for organizations with strict site user access controls.
Technical Context
Checkmk is an infrastructure and application monitoring platform. The vulnerability stems from CWE-426 (Untrusted Search Path), where the 'omd' command-a site management utility executed with root privileges-processes files from site user-controlled directories without proper sanitization or validation. Site users in Checkmk have administrative capabilities within their monitoring instance context but operate below OS root. The flaw enables a TOCTOU-like attack where a site user can manipulate configuration files, scripts, or other resources in their site directory that 'omd' subsequently trusts when invoked by root for administrative tasks like updates or restarts. This breaks the privilege boundary between site-level and system-level administration, allowing arbitrary code execution as root through crafted file content that 'omd' processes during its execution flow.
Affected Products
Checkmk monitoring platform versions are impacted across multiple release branches. The vulnerability affects Checkmk 2.2.0 which has reached end-of-life status and will not receive patches, Checkmk 2.3.0 prior to patch release 2.3.0p46, Checkmk 2.4.0 prior to patch release 2.4.0p25, and beta versions Checkmk 2.5.0b1 and 2.5.0b2 prior to 2.5.0b3. The affected product is identified by CPE cpe:2.3:a:checkmk_gmbh:checkmk covering all editions (Raw, Enterprise, and Cloud). Vendor Checkmk GmbH has published official guidance in Werk 18891 available at https://checkmk.com/werk/18891.
Remediation
Upgrade to vendor-released patched versions immediately to eliminate the privilege escalation vector. For Checkmk 2.3.0 branch, upgrade to version 2.3.0p46 or later. For Checkmk 2.4.0 branch, upgrade to version 2.4.0p25 or later. For Checkmk 2.5.0 beta users, upgrade to version 2.5.0b3 or later. Organizations running end-of-life Checkmk 2.2.0 must migrate to a supported release branch as no patch will be issued. Consult the official vendor advisory at https://checkmk.com/werk/18891 for detailed upgrade procedures and version-specific guidance. As a temporary risk reduction measure pending patching, audit and restrict site user access to only trusted administrators, implement monitoring for unexpected 'omd' command invocations, and review file integrity in site directories for unauthorized modifications. Note that workarounds do not address the root cause and patching remains the only complete remediation.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today