CVE-2024-0670
CVE-2024-0670 is a privilege escalation vulnerability affecting the Windows agent plugin in Checkmk. This flaw allows a local user to gain elevated privileges on the system if running a vulnerable version before 2.2.0p23, 2.1.0p40, and 2.0.0 (EOL). Although its SOCRadar Vulnerability Risk Score (SVRS) is 42, indicating a moderate risk, the fact that it's tagged as "In The Wild" warrants close monitoring. This vulnerability, categorized as CWE-427, involves an uncontrolled search path that attackers can exploit. While the CVSS score is 0, indicating no initial security impact, successful exploitation grants unauthorized administrative access. This significantly impacts the security and integrity of affected systems. Upgrade Checkmk to a patched version immediately. Failure to remediate could lead to full system compromise.
Description:
CVE-2024-0670 is a privilege escalation vulnerability in the Windows agent plugin for Checkmk versions prior to 2.2.0p23, 2.1.0p40, and 2.0.0 (EOL). This vulnerability allows a local user to escalate their privileges on the affected system. The SVRS for this CVE is 42, indicating a moderate level of risk.
Key Insights:
- This vulnerability can be exploited by a local user to gain elevated privileges on the affected system.
- The vulnerability is present in Checkmk versions prior to 2.2.0p23, 2.1.0p40, and 2.0.0 (EOL).
- The CVSS score for this vulnerability is 8.8, indicating a high level of severity.
Mitigation Strategies:
- Update Checkmk to version 2.2.0p23, 2.1.0p40, or later.
- Restrict access to the affected system to authorized users only.
- Implement a least privilege policy on the affected system.
Additional Information:
- There are no known active exploits for this vulnerability.
- CISA has not issued a warning for this vulnerability.
- The vulnerability is not known to be used in the wild.
If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.
Indicators of Compromise
Exploits
News
Social Media
Affected Software
References
CWE Details
CVE Radar
Real-time CVE Intelligence & Vulnerability Management Platform
CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.