CVE-2024-47091: Privilege Escalation in Checkmk Agent

This vulnerability poses a significant risk because it allows a local, unprivileged user to gain SYSTEM-level access to the affected Checkmk Agent. Successful exploitation grants the attacker complete control over the system, enabling them to install malware, steal sensitive data, modify system configurations, and potentially pivot to other systems on the network. The ability to create a service with a specific name makes exploitation relatively straightforward, particularly in environments where service creation permissions are not tightly controlled. The SYSTEM context provides the highest level of privileges on the Windows system, maximizing the potential impact of a successful attack. This is comparable to other local privilege escalation vulnerabilities where an attacker can leverage misconfigured service accounts.

1. Reserviert2024-09-18
2. Veröffentlicht2026-05-13
3. EPSS aktualisiert2026-05-13

The primary mitigation for CVE-2024-47091 is to upgrade Checkmk Agent to version 2.4.0p29 or later. If immediate upgrading is not possible due to compatibility issues or testing requirements, consider implementing stricter controls on Windows service creation. Restrict the ability to create services with names like 'MySQL' or 'MariaDB' to authorized users only. Additionally, review and harden the permissions associated with the Checkmk agent service itself. While a WAF or proxy cannot directly mitigate this vulnerability, network segmentation can limit the potential blast radius if the agent is compromised. There are no specific Sigma or YARA rules available for this vulnerability at this time.