CVE-2024-38862

What it actually does

Sensitive SNMP and IPMI secrets from host and folder properties are written into audit log files that are readable by administrators.

Why it matters to the business

Credential material that should remain protected can be viewed by anyone with administrative access to the monitoring system, increasing risk of unauthorized device access and complicating compliance.

How an attack unfolds

An authenticated administrator navigates to the audit log files and reads the stored host or folder properties, directly extracting SNMP community strings or IPMI credentials without further exploitation steps.

How to fix it

Upgrade Checkmk to version 2.3.0p18 or newer, 2.2.0p35 or newer, 2.1.0p48 or newer, or retire EOL 2.0.0 installations; restrict log file permissions to the minimum required administrative roles until patches are applied.

How to confirm the fix worked

Confirm the installed Checkmk version meets or exceeds the fixed releases listed above and inspect a sample audit log entry for a host containing SNMP or IPMI credentials to verify secrets are no longer recorded.

Typical attack path

1. Obtain administrative access to the Checkmk instance
2. Locate and open the audit log files containing host and folder configuration entries
3. Extract SNMP or IPMI secrets from the logged property values

How to detect it

Search audit log files and related configuration change records for entries that include SNMP community strings or IPMI username/password fields; correlate with administrative login events to identify any access to those logs.

What your security team should do

• Apply the listed version upgrades immediately on all affected instances
• Audit current audit log files for previously logged credentials and rotate any exposed secrets
• Review and tighten access controls on audit log storage locations