Cyber Resilience

CVE-2023-22318

Tribe29 Checkmk Appliance Firmware ≤ 1.6.5

Published
15 May 2023
Modified
21 November 2024
Patch / advisory
View advisory
CVSS Score v3.1 7.5
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS Score 0.0053 42th percentile
Risk Priority 58 floored blend · peak EPSS

Summary

CVE-2023-22318 is a high-severity Unrestricted Externally Accessible Lock (CWE-412) vulnerability in Tribe29 Checkmk Appliance Firmware. Its CVSS base score is 7.5 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Endpoint Denial of Service (T1499); ranked at the 42th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Denial of service in Webconf in Tribe29 Checkmk Appliance before 1.6.5.

CWE(s)
CWE-412CWE-667

Related Threats

MITRE ATT&CK Enterprise Techniques

T1499 Endpoint Denial of Service Impact
Adversaries may perform Endpoint Denial of Service (DoS) attacks to degrade or block the availability of services to users.
attack.mitre.org →
T1499.004 Application or System Exploitation Impact
Adversaries may exploit software vulnerabilities that can cause an application or system to crash and deny availability to users.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalation
Adversaries may exploit software vulnerabilities in an attempt to elevate privileges.
attack.mitre.org →
T1548 Abuse Elevation Control Mechanism Privilege Escalation
Adversaries may circumvent mechanisms designed to control privilege elevation to gain higher-level permissions.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2023-22307Same product: Tribe29 Checkmk Appliance Firmware
CVE-2023-6287Same product: Tribe29 Checkmk Appliance Firmware
CVE-2023-22309Same product: Tribe29 Checkmk Appliance Firmware
CVE-2026-62426Shared CWE-412, CWE-667
CVE-2023-22294Same vendor: Tribe29
CVE-2023-53013Shared CWE-667
CVE-2024-40969Shared CWE-667
CVE-2024-43863Shared CWE-667
CVE-2025-39885Shared CWE-667
CVE-2025-38373Shared CWE-667

Affected Assets

tribe29
checkmk appliance firmware
≤ 1.6.5

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing least-privilege authorization policies directly prevents external actors from acquiring or influencing locks.

PR.IR-01 mostly match
prevents

Logical access controls and segmentation stop unintended external influence over synchronization primitives.

PR.PS-06 mostly match
prevents

Secure SDLC practices directly include code reviews, static analysis, and concurrency standards that prevent improper locking.

ID.RA-01 partial match
prevents

Vulnerability identification processes can discover externally controllable locks before deployment.

PR.PS-01 partial match
prevents

Hardened configuration baselines can disable or restrict external lock exposure by default.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
finds

Security testing can detect race conditions and locking errors before release.

A.8.18 Use of privileged utility programs partial match
mitigates

Restricting privileged utilities can limit external lock manipulation but does not address the core weakness.

A.8.2 Privileged access rights partial match
mitigates

Privileged access rights limit who can create or manipulate locks, reducing external influence.

A.8.20 Networks security partial match
mitigates

Network security measures can block external access paths to locks but do not address the design flaw itself.

A.8.25 Secure development life cycle partial match
prevents

Secure development lifecycle practices can prevent introducing externally controllable locks during design.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate that locks remain within the intended control sphere.

References