SYSTEM code execution via attacker-controlled service path

Privilege escalation in Checkmk 2.2.0, 2.3.0 through 2.3.0p46, and 2.4.0 through 2.4.0p28 allows local users to execute code as SYSTEM. The Windows mk_mysql agent plug-in matches MySQL or MariaDB service names, trusts each matched service's binary path, and executes commands derived from that path. Exploitation requires permission to create a matching Windows service or write to its referenced binary, after which the Checkmk agent service typically executes the attacker's code as SYSTEM.