CVE-2024-13723 - CVE House
Back to Database
Status published Unknown CVE-2024-13723

Checkmk NagVis Remote Code Execution

Vulnerability Description

The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-13723

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • This vulnerability was discovered by Jaggar Henry and Jim Becher of KoreLogic, Inc.

References

More from Checkmk

View All →
CVE-2024-13722
Checkmk NagVis Reflected Cross-site Scripting
Unknown 0

Affected Vendor

Affected Software

NagVis
Vulnerable Versions:
NagVis 1.9.40, Checkmk 2.3.0p2

Timeline

Official Publish: February 4th, 2025
Last Modified: November 3rd, 2025
Added to House: July 22nd, 2026

CVSS Vectors

No vector data available

Weaknesses (CWE)

CWE-434

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1505.003 Web Shell
Persistence
T1105 Ingress Tool Transfer
Command and Control
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact