Back to Database
Status published
Medium
CVE-2025-3506
Potentially senitive path exposed via unauthenticated http route
Vulnerability Description
Files to be deployed with agents are accessible without authentication in Checkmk 2.1.0, Checkmk 2.2.0, Checkmk 2.3.0 and <Checkmk 2.4.0b6 allows attacker to access files that could contain secrets.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-3506
Credits & Attribution
The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:
- Norman Kühnberger (IT Südwestfalen GmbH)
References
More from Checkmk GmbH
View All →CVE-2025-65000
Exposure of SSH Private Keys in Remote Alert Handlers (Linux) Rule
Low
2.3
CVE-2025-64999
Cross-site scripting in HTML logs of Synthetic Monitoring test services
High
7.3
CVE-2025-64998
Session hijacking via exposed session signing secret in distributed Checkmk setups
High
7.3
CVE-2025-64997
Insufficient permission validation when showing agent information
Medium
6.3
CVE-2025-64996
Overly broad file permissions in the mk_inotify plugin allows reading and manipulating the plugin's output
Medium
4.8
Affected Vendor
Checkmk GmbH
View all reports →Affected Software
Checkmk
Vulnerable Versions:
2.4.0, 2.3.0, 2.2.0, 2.1.0
Timeline
Official Publish:
May 8th, 2025
Last Modified:
May 8th, 2025
Added to House:
July 22nd, 2026