CVE-2024-0670

What it actually does

The Windows agent plugin contains a flaw that permits a local authenticated user to execute code with elevated privileges, typically resulting in SYSTEM-level access on the host.

Why it matters to the business

A compromised low-privileged account on an endpoint running the agent can lead to full host takeover, enabling attackers to access sensitive data, deploy malware, or pivot within the environment; urgency is moderate given low exploitation metrics and absence from known campaigns.

How an attack unfolds

An attacker with an existing local account on a Windows system running an affected Checkmk agent interacts with the plugin to trigger the privilege-escalation condition and obtain higher rights without needing network access or user interaction.

How to fix it

Upgrade Checkmk agent installations to 2.2.0p23 or later, 2.1.0p40 or later, or apply the equivalent fix from commit 6a686961c4b760c55a13cfdb61e7c02be832a0be for GIT-based deployments; remove or disable EOL 2.0.0 versions.

How to confirm the fix worked

Verify installed agent version against the fixed releases, confirm the plugin binary or script matches the patched commit, and test that low-privileged accounts cannot obtain SYSTEM rights via the plugin.

Typical attack path

1. Obtain local user access on a Windows host running the Checkmk agent
2. Identify and interact with the vulnerable Windows agent plugin
3. Trigger the flaw to escalate from local user to SYSTEM privileges
4. Use elevated context to execute arbitrary commands or install persistent tools

How to detect it

Review Windows event logs for unexpected privilege changes or new processes spawned by the Checkmk agent under SYSTEM context; examine agent plugin execution history and any associated error or debug logs for anomalies around the time of suspected escalation.

What your security team should do

• Prioritize upgrade of all Windows Checkmk agents to the listed fixed versions within the next patching cycle
• Audit local accounts on monitored Windows hosts for unnecessary privileges
• Add agent version checks to configuration management and vulnerability scanning processes