CVE-2015-7743 in Network Monitor
Summary
by MITRE
XML external entity vulnerability in PRTG Network Monitor before 16.2.23.3077/3078 allows remote authenticated users to read arbitrary files by creating a new HTTP XML/REST Value sensor that accesses a crafted XML file.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 05/14/2026
The CVE-2015-7743 vulnerability represents a critical xml external entity processing flaw in PRTG Network Monitor versions prior to 16.2.23.3077/3078. This vulnerability falls under the CWE-611 weakness category, specifically addressing insecure direct object references and xml external entity processing issues. The flaw enables remote authenticated attackers to exploit the system by crafting malicious xml content that triggers unauthorized file access through the HTTP XML/REST Value sensor functionality.
The technical implementation of this vulnerability occurs within the sensor creation process where PRTG Network Monitor fails to properly validate or sanitize xml entities before processing them. When an authenticated user creates a new HTTP XML/REST Value sensor, the system accepts and processes xml content that may contain external entity declarations. These declarations can reference local files on the server through protocol handlers such as file:// or http://, allowing attackers to read arbitrary files from the system. The vulnerability stems from insufficient input validation and improper xml parsing mechanisms that do not restrict access to local resources during xml processing operations.
The operational impact of this vulnerability is significant as it provides attackers with the ability to extract sensitive information from the monitored network infrastructure. An attacker with valid credentials can access system files, configuration data, and potentially sensitive network information that could lead to further compromise. The vulnerability affects the confidentiality aspect of the security triad by enabling unauthorized data disclosure. Attackers could potentially access authentication credentials, network configurations, or other sensitive data stored on the PRTG server, making this a particularly dangerous flaw in network monitoring environments where privileged access is required.
This vulnerability aligns with several ATT&CK techniques including T1078 Valid Accounts for maintaining access and T1005 Data from Local System for information collection. The attack chain typically involves gaining initial access through valid credentials, creating a malicious sensor configuration, and then leveraging the xml external entity processing to read unauthorized files. Organizations using PRTG Network Monitor should implement immediate mitigations including applying the vendor-provided patches, restricting user permissions for sensor creation, and implementing network segmentation to limit access to the monitoring infrastructure. Additionally, regular security assessments should verify that xml processing components properly validate and sanitize all input before processing to prevent similar vulnerabilities in other applications.