CVE-2024-0670

CVE-2024-0670 – Local Privilege Escalation in CheckMK Agent PowerShell PoC Abstract This repository presents an independent PowerShell proof of concept for CVE-2024-0670 , a Windows local privilege escalation vulnerability in the CheckMK Agent. The vulnerability allows a low-privileged local user...

CVE-2024-0670-CheckMK-Agent-Local-Privilege-Escalation-Exploit

CVE-2024-0670 – CheckMK Agent Local Privilege Escalation PoC This repository contains a simple and clean proof-of-concept for CVE-2024-0670, a local privilege escalation vulnerability in the CheckMK Windows Agent. A low-privileged user can gain SYSTEM privileges by abusing writable temp file path...

msi-search

MSI Search Windows caches MSI files at C:\Windows\Installer\ with randomized filenames consisting of letters and numbers followed by the ".msi" extension. This tool simplifies the task for red team operators and security teams to identify which MSI files correspond to which software and enables...

mindmanager-poc

mindmanager-poc Affected application: MindManager23setup.exe Platform: Windows Issue: Local Privilege Escalation via MSI installer Repair Mode EXE hijacking race condition Discovered and reported by: Pawel Karwowski and Julian Horoszkiewicz Eviden Red Team Proposed mitigation:...

HTB-NanoCorp-CVE-2024-0670

CVE-2024-0670 - CheckMK Agent MSI Repair Privilege Escalation NanoCorp HTB This repository contains a PowerShell script used to exploit CVE-2024-0670 on the NanoCorp machine from Hack The Box. The vulnerability allows a low-privileged user to abuse the CheckMK Windows Agent MSI repair functionali...

Linux Distros Unpatched Vulnerability : CVE-2026-83598

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without...

EUVD-2026-84567

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

CVE-2026-83597 Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

CVE-2026-83597 Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

CVE-2026-83597 Netdata: Local Privilege Escalation in Netdata Windows Agent installer via MSI Repair Execution

Netdata is an open source observability tool. From version 2.0.0 until 2.10.4, Netdata Windows Agent MSI repair launches powershell.exe and wevtutil.exe as elevated interactive processes in the initiating user's desktop session. A low-privileged local user who triggers repair can interact with or...

EUVD-2026-84565

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

CVE-2026-83598 Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

CVE-2026-83598 Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

CVE-2026-83598 Netdata: Local Privilege Escalation in Netdata Agent Windows installer via PowerShell Profile Hijack in MSI Repair

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

CVE-2026-83598: Improper Privilege Management

Netdata is an open source observability tool. From rom 2.0.0 until 2.10.4, during Netdata Windows Agent MSI repair, powershell.exe runs as SYSTEM without -NoProfile and loads %USERPROFILE%\Documents\WindowsPowerShell\Microsoft.PowerShellprofile.ps1 from the low-privileged user who initiated repai...

PT-2026-96843

Name of the Vulnerable Software and Affected Versions Netdata Windows Agent versions 2.0.0 through 2.10.3 Description The MSI repair process launches powershell.exe and wevtutil.exe as elevated interactive processes within the user's desktop session. A low-privileged local user can trigger this...

PT-2026-96844

Name of the Vulnerable Software and Affected Versions Netdata versions 2.0.0 through 2.10.3 Description During the MSI repair process of the Netdata Windows Agent, powershell.exe is executed with SYSTEM privileges without the -NoProfile flag. This causes the system to load the Microsoft.PowerShel...

HTB-NanoCorp-CVE-2024-0670

CVE-2024-0670 - Escalada de Privilegios en la Reparación MSI del Agente CheckMK NanoCorp HTB Este repositorio contiene un script de PowerShell utilizado para explotar CVE-2024-0670 en la máquina NanoCorp de Hack The Box. La vulnerabilidad permite a un usuario con pocos privilegios abusar de la...

Exploit for Uncontrolled Search Path Element in Checkmk

CVE-2024-0670 - CheckMK Agent MSI Repair Privilege Escalation...

Rockwell Automation FactoryTalk Linx

RISK EVALUATION Successful exploitation of these vulnerabilities may allow full access to all files, processes, and system resources. 2. RECOMMENDED PRACTICES CISA reminds organizations to perform proper impact analysis and risk assessment prior to deploying defensive measures. CISA also...