CVEvulnerability

CVE-2018-9276

7.2 HIGH Known exploited Published 2018-07-02 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Paessler PRTG Network Monitor OS Command Injection Vulnerability — Paessler PRTG Network Monitor

Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.

Added to KEV: 2025-02-04
Remediation due: 2025-02-25
Ransomware use: Unknown
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Notes: https://www.paessler.com/prtg/history/prtg-18#18.2.39 ; https://nvd.nist.gov/vuln/detail/CVE-2018-9276

Status: Analyzed
Published: 2018-07-02
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0): 7.2 HIGH — CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 9.0 HIGH — AV:N/AC:L/Au:S/C:C/I:C/A:C
Weaknesses: CWE-78

Description

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.

Affected configurations

• paessler prtg network monitor (< 18.2.39) • paessler prtg network monitor (> 19.3.52 < 21.2.68)

Weakness · CWE (1)

CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References