CVE-2021-40904

HighCVSS 8.8

Published: 25/03/2022(UTC)Updated: 09/07/2026(UTC)Translated: 10/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

High risk

3.46%

88th percentile - higher than 88% of all known CVEs

Summary

The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) has a misconfiguration of the default Dokuwiki web app, allowing embedded PHP code. This leads to remote code execution. Exploitation requires access to the management interface with valid credentials or a hijacked admin session.

Risk Assessment

An attacker with admin privileges can gain full control over the CheckMK server, compromising the confidentiality, integrity, and availability of the monitored IT infrastructure.

Recommendation

Immediately upgrade CheckMK Raw Edition to version 1.6.0p8 or later, which includes the fix. Additionally, restrict management console access to trusted IP addresses and enforce strong multi-factor authentication.

Other vulnerabilities in CheckMK Raw Edition

CVE-2021-40906Medium
CheckMK Raw Edition versions 1.5.0 to 1.6.0 do not sanitize input of a web service parameter in an unauthenticated zone. This Reflected XSS allows an attacker to open a backdoor with HTML content interpreted by the browser (e.g., JavaScript) or steal session cookies of an authenticated user via man-in-the-middle.

Original NVD description (English source)

The web management console of CheckMK Raw Edition (versions 1.5.0 to 1.6.0) allows a misconfiguration of the web-app Dokuwiki (installed by default), which allows embedded php code. As a result, remote code execution is achieved. Successful exploitation requires access to the web management interface, either with valid credentials or with a hijacked session by a user with the role of administrator.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS