CVE-2018-9276 An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injecti...
HighCVSS 7.2
EPSS 86.9%
CISA KEV
added 2025-02-04 · due 2025-02-25
Exploited in the wild
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Exploited in the wild (confirmed)
Description
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
CISA Known Exploited Vulnerability
- Date added
- 2025-02-04
- Due date (FCEB)
- 2025-02-25
- Ransomware use
- Unknown
Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| paessler PRTG Network Monitor | < 18.2.39 | 18.2.39 |
| paessler PRTG Network Monitor | >= 19.3.52, < 21.2.68 | 21.2.68 |
References
- packetstormsecurity.com exploit mitigation third-party-advisory vdb-entry
- packetstormsecurity.com exploit third-party-advisory vdb-entry
- 20180626 PRTG < 18.2.39 Command Injection broken-link mailing-list third-party-advisory vdb-entry
- 46527 exploit third-party-advisory vdb-entry
- www.cisa.gov government-resource us-government-resource