CVE-2025-32919: Checkmk Privilege Escalation Vulnerability

CVE-2025-32919 Overview

CVE-2025-32919 affects the Windows License plugin shipped with the Checkmk Windows Agent. The plugin uses an insecure temporary directory during execution, enabling a local, low-privileged attacker to escalate privileges on the monitored host. The weakness is classified under [CWE-427] (Uncontrolled Search Path Element) and stems from operations performed in a directory writable by non-administrative users while the agent runs with elevated rights.

Critical Impact
A local user with low privileges can leverage the insecure temporary directory to execute code in the security context of the Checkmk Windows Agent, resulting in full compromise of confidentiality, integrity, and availability on the host.

Affected Products

Checkmk 2.4.0 before 2.4.0p13
Checkmk 2.3.0 before 2.3.0p38
Checkmk 2.2.0 before 2.2.0p46
Checkmk 2.1.0 (all versions, end-of-life)

Discovery Timeline

2025-10-09 - CVE-2025-32919 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-32919

Vulnerability Analysis

The Checkmk Windows Agent ships a License plugin that writes and reads files in a temporary directory during normal operation. The agent itself runs with elevated privileges to collect system telemetry. When the plugin performs file operations in a directory that grants write access to standard users, an attacker on the same host can influence what the agent loads or executes. The result is local privilege escalation from a low-privileged user account to the security context of the agent.

Because the flaw is exploited locally through file system interactions, it does not expose the vulnerability to remote attackers directly. It becomes valuable in post-compromise scenarios where an initial foothold on a Windows host needs to be upgraded to elevated privileges.

Root Cause

The root cause is the use of an insecure temporary directory by the Windows License plugin. Standard users retain write permissions on the location, while the agent that consumes files from it operates with higher privileges. This creates the conditions described in [CWE-427], where an attacker plants a malicious file or DLL that the privileged process resolves and loads.

Attack Vector

An attacker with a local, low-privileged account on the Windows host places a crafted file, such as a DLL or executable payload, into the plugin's temporary directory. When the Checkmk Windows Agent runs the License plugin, the attacker-controlled file is loaded or executed in the agent's privileged context. Refer to the GitHub Security Advisory SBA-ADV-20250724-01 for the researcher's technical write-up.

Detection Methods for CVE-2025-32919

Indicators of Compromise

Unexpected executable files, DLLs, or scripts appearing in the Checkmk Windows Agent temporary directory used by the License plugin.
New child processes spawned by the Checkmk Windows Agent that do not match legitimate plugin binaries.
Modification of files in agent working directories by non-administrative user accounts.

Detection Strategies

Monitor file creation and modification events in the Checkmk Windows Agent temporary and plugin directories.
Alert on privileged process executions whose image path or loaded modules originate from user-writable directories.
Correlate agent plugin execution with recent file writes by low-privileged users to identify TOCTOU-style exploitation.

Monitoring Recommendations

Enable Windows Sysmon Event IDs 1 (process creation) and 11 (file create) on hosts running the Checkmk Windows Agent.
Audit the ACLs of directories used by the agent and its plugins to confirm they exclude standard users.
Review Checkmk Windows Agent logs for License plugin execution anomalies following the vendor advisory Checkmk Werk 18207.

How to Mitigate CVE-2025-32919

Immediate Actions Required

Upgrade the Checkmk Windows Agent to a fixed release: 2.4.0p13, 2.3.0p38, or 2.2.0p46 or later.
Retire hosts still running Checkmk 2.1.0, which is end-of-life and will not receive a patch.
Audit directory permissions on the paths used by the Windows License plugin and restrict write access to administrators and SYSTEM.

Patch Information

Checkmk released fixes described in Checkmk Werk 18207. Apply version 2.4.0p13, 2.3.0p38, or 2.2.0p46, depending on the deployed branch. No fix is available for 2.1.0 because that branch has reached end-of-life; upgrade to a supported branch.

Workarounds

Disable the Windows License plugin on affected agents until the update is applied.
Restrict interactive and local logon rights on monitored Windows hosts to limit the pool of users who can exploit the flaw.
Enforce least privilege on the temporary directory used by the plugin, removing write permissions for non-administrative principals.

bash

# Example: remove inherited write permissions for standard users on the plugin temp directory
icacls "C:\ProgramData\checkmk\agent\tmp" /inheritance:r
icacls "C:\ProgramData\checkmk\agent\tmp" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "C:\ProgramData\checkmk\agent\tmp" /remove "Users" "Authenticated Users"