Back to Database
Status published
High
CVE-2024-28827
Privilege escalation in Windows agent
Vulnerability Description
Incorrect permissions on the Checkmk Windows Agent's data directory in Checkmk < 2.3.0p8, < 2.2.0p29, < 2.1.0p45, and <= 2.0.0p39 (EOL) allows a local attacker to gain SYSTEM privileges.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-28827
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- modzero GmbH
References
More from Checkmk GmbH
View All →CVE-2025-65000
Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule
Low
2.3
CVE-2025-64999
Cross-site scripting in HTML logs of Synthetic Monitoring test services
High
7.3
CVE-2025-64998
Session hijacking via exposed session signing secret in distributed Checkmk setups
High
7.3
CVE-2025-64997
Insufficient permission validation when showing agent information
Medium
6.3
CVE-2025-64996
Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output
Medium
4.8
Affected Vendor
Checkmk GmbH
View all reports →Affected Software
Checkmk
Vulnerable Versions:
2.3.0, 2.2.0, 2.1.0, 2.0.0
Timeline
Official Publish:
July 10th, 2024
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H