CVE-2024-38861
📋 TL;DR
The Checkmk Exchange plugin for MikroTik has improper certificate validation, allowing attackers in a man-in-the-middle position to intercept and potentially manipulate traffic between Checkmk and MikroTik devices. This affects organizations using the vulnerable plugin versions to monitor MikroTik network equipment.
💻 Affected Systems
- Checkmk Exchange plugin MikroTik
📦 What is this software?
Mikrotik by Tomtretbar
⚠️ Risk & Real-World Impact
Worst Case
Attackers could intercept sensitive monitoring data, inject malicious commands to MikroTik devices, or redirect traffic through attacker-controlled systems, potentially leading to network compromise.
Likely Case
Monitoring data interception allowing attackers to gather network topology information, device configurations, and performance metrics.
If Mitigated
Limited to internal network visibility if proper network segmentation and certificate validation are in place.
🎯 Exploit Status
Requires man-in-the-middle position between Checkmk server and MikroTik devices. No public exploit code identified.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.5.6 or later
Vendor Advisory: https://exchange.checkmk.com/p/mikrotik
Restart Required: Yes
Instructions:
1. Update Checkmk to latest version. 2. Update MikroTik plugin to version 2.5.6 or later via Checkmk Exchange. 3. Restart Checkmk services.
🔧 Temporary Workarounds
Network Segmentation
allIsolate Checkmk server and MikroTik devices on separate VLANs with strict access controls.
Certificate Pinning
allManually configure certificate validation for MikroTik device connections.
🧯 If You Can't Patch
- Implement strict network segmentation between monitoring systems and managed devices
- Monitor network traffic between Checkmk and MikroTik devices for anomalies
🔍 How to Verify
Check if Vulnerable:
Check plugin version in Checkmk Exchange interface under 'Installed Plugins' for MikroTik plugin.Check Version:
Checkmk web interface: Setup → Extensions → Installed extensions → MikroTikVerify Fix Applied:
Verify plugin version is 2.5.6 or later and test certificate validation by attempting to connect with invalid certificates.📡 Detection & Monitoring
Log Indicators:
- Failed certificate validation attempts in Checkmk logs
- Unexpected connection resets between Checkmk and MikroTik devices
Network Indicators:
- Unencrypted traffic between Checkmk and MikroTik devices
- Unexpected SSL/TLS handshake failures
SIEM Query:
source="checkmk" AND ("certificate" OR "SSL" OR "TLS") AND ("failed" OR "invalid" OR "rejected")