A local unprivileged user can create or modify a Windows service whose name matches 'MySQL' or 'MariaDB', or otherwise gain write access to a binary referenced by such a service. The service runs under the Checkmk agent service, which typically executes with SYSTEM privileges. As a result, an attacker can run arbitrary code with full administrative rights, enabling malware installation, database compromise, or further lateral movement. The weakness maps to CWE-427, an untrusted search path flaw that allows malicious binaries to be loaded and executed.

The affected product is Checkmk from Checkmk GmbH. Vulnerable releases include any Checkmk build before 2.4.0p29, before 2.3.0p47, and the EOL 2.2.0 version. These builds are listed in the input CPE data and are impacted by this flaw.

The CVSS score of 5.2 indicates moderate severity, and the EPSS score is not available. The vulnerability is not listed in CISA’s KEV catalog, suggesting no widely known exploits yet. Attack requires local user access with the ability to create or modify Windows services; thus the attack vector is local. Once achieved, the attacker gains full SYSTEM privileges and can execute arbitrary code on the host.