CVE-2024-47091 Checkmk GmbH CVE debrief

Who should care

Windows Checkmk users, system administrators, security teams, and operators managing Checkmk environments should be aware of this vulnerability. They should assess their exposure, apply patches, and monitor for suspicious activity. Vulnerability management and security teams need to prioritize patching and review compensating controls for exposed systems.

Why it matters

CVE-2024-47091 is a privilege escalation vulnerability in Checkmk's mk_mysql agent plugin on Windows, allowing local unprivileged users to execute arbitrary code as SYSTEM. Defenders should apply patches, restrict local access, and monitor for suspicious activity.

• Local unprivileged users can execute arbitrary code as SYSTEM
• Checkmk agent service typically runs as SYSTEM
• Requires local access and specific service name matching
• Patching required for versions <2.4.0p29, <2.3.0p47, and 2.2.0

Technical summary

The mk_mysql agent plugin on Windows in Checkmk <2.4.0p29, <2.3.0p47, and 2.2.0 (EOL) has a privilege escalation vulnerability allowing a local unprivileged user to execute arbitrary code in the context of the Checkmk agent service, which typically runs as SYSTEM. This vulnerability is due to improper handling of service creation and execution in the context of the Checkmk agent. Technical details indicate that the vulnerability requires local access and specific service name matching. Defenders should focus on applying patches and restricting local access.

Defensive priority

Apply patches for Checkmk versions <2.4.0p29, <2.3.0p47, and 2.2.0; restrict local unprivileged user access; monitor for suspicious service creation.

Recommended defensive actions

• Apply patches for Checkmk versions <2.4.0p29, <2.3.0p47, and 2.2.0
• Restrict local unprivileged user access
• Monitor for suspicious service creation
• Review compensating controls for exposed systems
• Check relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets
• Confirm whether affected product deployments exist in managed environments

Evidence notes

The CVE description details a local privilege escalation vulnerability in Checkmk's mk_mysql agent plugin on Windows, allowing a local unprivileged user to execute arbitrary code as the Checkmk agent service, typically running as SYSTEM. Evidence is based on the CVE description and vendor advisory. Defenders should verify affected Checkmk versions and configurations, assess local access controls, and monitor for suspicious service creation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.