Incorrect Permissions in Checkmk Agent Allow Local Data Access
CVE-2025-32915

4.3MEDIUM

Key Information:

Vendor

Checkmk Gmbh

Status
Checkmk
Vendor
CVE Published:
22 May 2025

What is CVE-2025-32915?

An issue exists in Checkmk's automatic agent updates for Linux and Solaris where downloaded packages have improper permissions. This vulnerability affects versions below 2.4.0p1, 2.3.0p32, 2.2.0p42, and 2.1.0p49. A local attacker could exploit this flaw to access sensitive data inadvertently. Proper permissions are crucial for maintaining data confidentiality and integrity, and users should ensure their systems are updated to mitigate potential risks.

Affected Version(s)

Checkmk 2.4.0 < 2.4.0p1

Checkmk 2.3.0 < 2.3.0p32

Checkmk 2.2.0 < 2.2.0p42

References

https://checkmk.com/werk/17099

CVSS V4

Score:
4.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.