Actively exploited in the wild
Paessler PRTG Network Monitor OS Command Injection Vulnerability
Paessler - PRTG Network Monitor · Listed in the CISA KEV since 2025-02-04. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CVE-2018-9276
HighCVSS 7.2KEVSummary
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
Risk Assessment
An attacker with administrative privileges can execute arbitrary OS commands, potentially leading to full compromise of the PRTG server and connected devices.
Recommendation
Update PRTG Network Monitor to version 18.2.39 or later.
Other vulnerabilities in PRTG Network Monitor
See all- CVE-2018-19410CriticalActively exploited
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
- CVE-2023-22632Low
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the FTP Server Count Sensor.
- CVE-2023-22631Low
PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor.
Original NVD description (English source)
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.