CVE-2025-1712— Arbitrary file write with vcrtrace
Possible ATT&CK Techniques 1AI
T1190 · Exploit Public-Facing ApplicationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2025-1712
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Arbitrary file write with vcrtrace
Source: CVE Program / CVE List V5
Vulnerability Description
Argument injection in special agent configuration in Checkmk <2.4.0p1, <2.3.0p32, <2.2.0p42 and 2.1.0 allows authenticated attackers to write arbitrary files
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
参数注入或修改
Source: CVE Program / CVE List V5
Vulnerability Title
Checkmk 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Checkmk是Checkmk公司的一个 IT 监控平台。 Checkmk 2.4.0p1之前版本、2.3.0p32之前版本、2.2.0p42之前版本和2.1.0版本存在安全漏洞，该漏洞源于特殊代理配置中的参数注入允许认证攻击者写入任意文件。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Checkmk GmbH | Checkmk | 2.4.0 ~ 2.4.0p1 | - |
II. Public POCs for CVE-2025-1712
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2025-1712
请登录查看更多情报信息。
IV. Related Vulnerabilities
Same weakness: CWE-88
- CVE-2026-16796
Improper neutralization of argument delimiters in AWS Bedroc - CVE-2026-44210
Kata Containers have VM Escape via virtiofsd Argument Inject - CVE-2026-44189
Ansible-lightspeed: visual studio code ansible lightspeed ex - CVE-2026-16493
Ansible-core: argument injection in ansible-galaxy collectio - CVE-2026-15793
Git source checkout from a bundle file could lead to command
V. Comments for CVE-2025-1712
No comments yet