A flaw in Checkmk’s notification test mode allows an authenticated user who can access the test page to insert crafted service descriptions that are interpreted as arbitrary Livestatus commands. The injected commands can then be executed against the monitoring system’s Livestatus interface, enabling the attacker to query, modify, or otherwise manipulate monitoring data in ways not intended by the configuration.

Checkmk GmbH Checkmk installations running versions earlier than 2.5.0b4 in the 2.5 branch or earlier than 2.4.0p26 in the 2.4 branch are affected. Only deployments that use the legacy notification test feature are vulnerable; newer releases have addressed the issue.

The CVSS score of 5.1 indicates moderate severity. No EPSS value is provided, so the likelihood of exploitation remains uncertain. The vulnerability is not listed in CISA’s KEV catalog. Because the flaw requires an authenticated user with access to the notification test page, the most likely attack vector is an internal attacker or one who has gained valid credentials and sufficient privileges. This inference is based on the description and is not explicitly detailed in the provided data.