CVE-2018-9276 | BDVDB-2026-103222 Detail
PaesslerPRTG Network Monitor
Description#
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
Impact#
Per CVSS v3.1: confidentiality impact high, integrity impact high, availability impact high. Attack vector: network.
Weaknesses#
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
References#
- http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html
- https://www.exploit-db.com/exploits/46527/
- http://www.securityfocus.com/archive/1/542103/100/0/threaded
- http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-9276
Exploit#
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.