PT-2025-22483 · Checkmk · Checkmk

Published 2025-05-22 · Updated 2025-05-23 · CVE-2025-32915

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Checkmk versions prior to 2.4.0p1 Checkmk versions prior to 2.3.0p32 Checkmk versions prior to 2.2.0p42 Checkmk versions prior to or equal to 2.1.0p49

Description The issue arises from incorrect permissions of packages downloaded by Checkmk's automatic agent updates on Linux and Solaris. This allows a local attacker to read sensitive data.

Recommendations For versions prior to 2.4.0p1, update to version 2.4.0p1 or later. For versions prior to 2.3.0p32, update to version 2.3.0p32 or later. For versions prior to 2.2.0p42, update to version 2.2.0p42 or later. For versions prior to or equal to 2.1.0p49, update to a version later than 2.1.0p49, considering 2.1.0p49 is end-of-life.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2025-32915

Affected Products

Checkmk

References · 8

• https://cve.org/CVERecord?id=CVE-2025-32915 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-32915 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-32915 · Vendor Advisory
• https://checkmk.com/werk/17099 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-32915 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32915 · Vendor Advisory
• https://twitter.com/CVEnew/status/1925561879247602037 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1925591154101231808 · Twitter Post