CVE-2025-32918
HIGHDescription
Improper neutralization of Livestatus command delimiters in autocomplete endpoint within the RestAPI of Checkmk versions <2.4.0p6, <2.3.0p35, <2.2.0p44, and 2.1.0 (EOL) allows an authenticated user to inject arbitrary Livestatus commands.
CVSS v3.1 Score
Weakness Type (CWE)
Affected Products
| Vendor | Product |
|---|---|
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
| checkmk | checkmk |
References
Advisories & Patches
Frequently Asked Questions
What is CVE-2025-32918? +
How severe is CVE-2025-32918? +
What products are affected by CVE-2025-32918? +
How do I check if I'm vulnerable to CVE-2025-32918? +
Related Vulnerabilities
Improper neutralization of livestatus command delimiters in a specific endpoint within RestAPI of Checkmk prior to 2.2.0p39, 2.3.0p25, and 2.1.0p51 …
Asterisk is an open-source private branch exchange (PBX). Prior to versions 18.26.2, 20.14.1, 21.9.1, and 22.4.1 of Asterisk and versions …
Improper neutralization of input in Nagvis before version 1.9.47 which can lead to livestatus injection
Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk <= 2.0.0p39, < 2.1.0p47, < 2.2.0p32 and < 2.3.0p11 allows …
OctoPrint versions up until and including 1.11.1 contain a vulnerability that allows any unauthenticated attacker to send a manipulated broken …
An Improper Neutralization of Delimiters vulnerability in the UI of Juniper Networks Junos OS and Junos OS Evolved allows a …