CVE-2018-9276

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.

Score

CVSS 3.1 7.2 High

Status

Analyzed - cve@mitre.org

Published

2018-07-02

Last modified

2025-10-21

Known exploited (CISA KEV)

since 2025-02-04, action due 2025-02-25: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Weaknesses

CWE-78

Affected products

• Prtg Network Monitor (Paessler)

References

• http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html
• http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html
• http://www.securityfocus.com/archive/1/542103/100/0/threaded
• https://www.exploit-db.com/exploits/46527/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-9276