CVE-2024-6542

What it actually does

Improper neutralization of livestatus command delimiters in mknotifyd allows arbitrary livestatus command execution.

Why it matters to the business

Attackers could manipulate monitoring notifications and commands, disrupting IT operations and monitoring integrity across affected Checkmk deployments with no remediation deadline or ransomware usage reported.

How an attack unfolds

An attacker sends crafted network requests containing malicious livestatus command delimiters to the mknotifyd service, which fails to properly sanitize them, resulting in execution of arbitrary commands; no named threat actors or campaigns are associated.

How to fix it

Upgrade Checkmk to a version beyond the vulnerable ranges (<= 2.0.0p39, < 2.1.0p47, < 2.2.0p32, < 2.3.0p11) for the installed branch; no fixed versions were explicitly listed.

How to confirm the fix worked

Confirm the deployed Checkmk version exceeds the vulnerable ranges and validate that delimiter handling in livestatus commands prevents injection.

Typical attack path

1. Identify exposed Checkmk instance running a vulnerable mknotifyd version
2. Craft malicious livestatus command payload using unneutralized delimiters
3. Transmit the payload over the network to the mknotifyd service
4. Trigger execution of arbitrary livestatus commands

How to detect it

Inspect mknotifyd logs and livestatus command histories for suspicious delimiter patterns or unexpected command executions; no threat actor indicators apply.

What your security team should do

• Upgrade all Checkmk installations to non-vulnerable versions immediately given the 811 days since publication
• Restrict network exposure of mknotifyd services
• Audit monitoring logs for anomalous livestatus activity