CVE-2024-47092

CVE-2024-47092, published on 2025-03-03, is a critical vulnerability rated at CVSS 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) stemming from insecure deserialization (CWE-502) and improper certificate validation. It affects the Checkmk Exchange plugin check-mk-api in versions prior to 5.8.1, a component used within Checkmk monitoring environments for API interactions.

Remote attackers require only network access to exploit this vulnerability, with low attack complexity, no privileges, authentication, or user interaction needed. Successful exploitation enables high-impact consequences across confidentiality, integrity, and availability, allowing attackers to potentially execute arbitrary code or fully compromise affected systems.

Advisories recommend updating the check-mk-api plugin to version 5.8.1 or later for mitigation. A specific fix is implemented in the GitHub commit b5a2a7529e3367d7a643e66f05da4f2a27013904 from the HeinleinSupport/check_mk_extensions repository, with further details available on the Checkmk Exchange plugin page.