QwikSec

Security Database

CVE

CWE

Training

CVE-2024-13723

Published: Feb 4, 2025

Modified: Nov 3, 2025

PUBLISHED

Description

The "NagVis" component within Checkmk is vulnerable to remote code execution. An authenticated attacker with administrative level privileges is able to upload a malicious PHP file and modify specific settings to execute the contents of the file as PHP.

Vendor	Product	Versions
Checkmk	NagVis	affected `NagVis 1.9.40 - < 1.9.42` affected `Checkmk 2.3.0p2 - < 2.3.0p10`

Weaknesses (CWE)

References

https://korelogic.com/Resources/Advisories/KL-001-2025-002.txt

third-party-advisory

https://www.nagvis.org/downloads/changelog/1.9.42

release-notes

https://checkmk.com/werks?version=2.3.0p10

release-notes

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.