CVE-2024-28827

What it actually does

Incorrect permissions on the Checkmk Windows Agent data directory allow a local attacker to modify files and achieve SYSTEM-level code execution.

Why it matters to the business

Attackers with local access can fully compromise affected Windows systems running the monitoring agent, leading to complete loss of confidentiality, integrity, and availability; no ransomware association or CISA deadline applies but the high CVSS and stable low EPSS indicate moderate urgency for patching.

How an attack unfolds

A local authenticated attacker locates the Checkmk Windows Agent data directory, leverages the weak permissions to plant or alter executables or configuration files, then triggers the agent service to run the malicious content with SYSTEM privileges.

How to fix it

Upgrade Checkmk installations to 2.3.0p8 or newer, 2.2.0p29 or newer, or 2.1.0p45 or newer; migrate any remaining 2.0.0p39 or older EOL instances to a supported release.

How to confirm the fix worked

Verify agent version numbers against the fixed releases, audit directory permissions on the data folder, and confirm no unauthorized modifications exist in the agent directory.

Typical attack path

1. Obtain low-privileged local access on a Windows host running the vulnerable Checkmk agent
2. Locate the agent data directory with overly permissive ACLs
3. Write or replace files to achieve code execution
4. Trigger agent functionality or service restart to run as SYSTEM

How to detect it

Search Windows event logs and file-system audit trails for unexpected writes or ownership changes inside the Checkmk agent data directory; examine process creation events where the agent service spawns unexpected child processes.

What your security team should do

• Prioritize patching all Checkmk Windows agents to the listed fixed versions
• Review and tighten ACLs on agent data directories as a compensating control
• Monitor for local privilege-escalation attempts via endpoint detection tools