CVE-2024-47091 is a vulnerability in Checkmk's mk_mysql agent plugin on Windows platforms that allows local privilege escalation. The issue occurs because the plugin improperly trusts Windows services named 'MySQL' or 'MariaDB' or binaries referenced by these services. A local unprivileged user with the ability to create such a service or modify the binary can execute arbitrary code in the context of the Checkmk agent service, which typically runs with SYSTEM privileges. This is classified as CWE-427 (Uncontrolled Search Path Element). The vulnerability affects Checkmk versions before 2.4.0p29, 2.3.0p47, and the EOL 2.2.0 version. The CVSS 4.0 base score is 5.2, indicating medium severity. No official patch or remediation level has been published by Checkmk GmbH as of the data provided.

Successful exploitation allows a local unprivileged user to escalate privileges to SYSTEM by executing arbitrary code through the Checkmk agent service on affected Windows systems. This could lead to full control over the affected host. However, exploitation requires local access and the ability to create or modify specific Windows services or binaries, limiting the attack surface. There are no known exploits in the wild at this time.

No official patch or remediation guidance is currently available from the vendor. Users should monitor Checkmk GmbH advisories for updates or patches addressing this vulnerability. As a precaution, restrict permissions to create or modify Windows services named 'MySQL' or 'MariaDB' and control write access to binaries referenced by such services to trusted administrators only. Avoid running vulnerable versions in environments where unprivileged users have local service creation rights.