This vulnerability in Checkmk arises from improper neutralization of delimiters in the notification test mode, enabling an authenticated user with access to the notification test page to inject arbitrary Livestatus commands through a specially crafted service description. The affected versions are Checkmk prior to 2.5.0b4 and 2.4.0p26. The CVSS 4.0 base score is 5.1, reflecting medium severity with network attack vector, low complexity, and no user interaction required. The vulnerability is identified as CWE-140 and does not have a confirmed remediation level or patch available as per the current vendor data.

An authenticated user with access to the notification test page can execute arbitrary Livestatus commands, potentially leading to unauthorized information disclosure or manipulation within the monitoring system. The impact is limited by the requirement for authenticated access with high privileges and the low scope impact indicated by the CVSS vector. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict access to the notification test page to trusted users only and monitor for unusual activity related to Livestatus commands. Avoid using vulnerable versions of Checkmk in untrusted environments.