CVE-2025-64997
📋 TL;DR
This vulnerability allows low-privileged users in Checkmk monitoring systems to access agent information through the REST API without proper authorization. It affects Checkmk versions before 2.4.0p17 and 2.3.0p42, potentially exposing sensitive monitoring data to unauthorized users.
💻 Affected Systems
- Checkmk
📦 What is this software?
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
Checkmk by Checkmk
⚠️ Risk & Real-World Impact
Worst Case
Attackers could map the entire monitoring infrastructure, identify vulnerable systems, and use agent information to launch targeted attacks against monitored endpoints.
Likely Case
Unauthorized users within the organization access monitoring data they shouldn't see, potentially learning about system configurations, network topology, or sensitive application information.
If Mitigated
With proper network segmentation and access controls, the impact is limited to information disclosure within the monitoring system itself.
🎯 Exploit Status
Exploitation requires valid low-privileged user credentials and access to the REST API endpoint.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2.4.0p17 or 2.3.0p42
Vendor Advisory: https://checkmk.com/werk/18681
Restart Required: Yes
Instructions:
1. Backup your Checkmk configuration. 2. Update to Checkmk 2.4.0p17 (for 2.4.x branch) or 2.3.0p42 (for 2.3.x branch). 3. Restart Checkmk services. 4. Verify the update was successful.
🔧 Temporary Workarounds
Restrict REST API Access
allLimit access to the REST API endpoint to only authorized users or networks
Configure firewall rules to restrict access to Checkmk API port (typically 5000/tcp)
Use web server configuration to restrict API endpoint access
Review User Permissions
linuxAudit and reduce low-privileged user accounts with REST API access
omd su <site> cmk -U list
Review and modify user permissions in Checkmk GUI
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Checkmk API from untrusted networks
- Enable detailed audit logging for all REST API access and monitor for suspicious activity
🔍 How to Verify
Check if Vulnerable:
Check Checkmk version: omd version or check_mk --version. If version is below 2.4.0p17 (for 2.4.x) or 2.3.0p42 (for 2.3.x), system is vulnerable.Check Version:
omd versionVerify Fix Applied:
After patching, verify version shows 2.4.0p17 or higher (for 2.4.x) or 2.3.0p42 or higher (for 2.3.x). Test with low-privileged user that agent information is no longer accessible via REST API.📡 Detection & Monitoring
Log Indicators:
- Unusual REST API access patterns from low-privileged users
- Multiple requests to agent information endpoints from non-admin accounts
Network Indicators:
- Increased traffic to /api endpoints from unexpected sources
- Pattern of enumeration requests to agent-related API endpoints
SIEM Query:
source="checkmk.log" AND ("GET /api/" OR "POST /api/") AND user!="admin" AND ("agent" OR "host")