PRTG Network Monitor up to 18.2.38 Web Console Parameter os command injection

Summaryinfo

A vulnerability was found in PRTG Network Monitor up to 18.2.38. It has been rated as critical. Impacted is an unknown function of the component Web Console. This manipulation as part of Parameter causes os command injection. The identification of this vulnerability is CVE-2018-9276. It is possible to initiate the attack remotely. Furthermore, there is an exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability classified as critical was found in PRTG Network Monitor up to 18.2.38 (Network Management Software). Affected by this vulnerability is an unknown function of the component Web Console. The manipulation as part of a Parameter leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.

The bug was discovered 06/27/2018. The weakness was shared 07/02/2018 as not defined posting (Bugtraq). The advisory is shared at securityfocus.com. This vulnerability is known as CVE-2018-9276 since 04/04/2018. The attack can be launched remotely. The successful exploitation requires a single authentication. Technical details are unknown but a public exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

It is possible to download the exploit at packetstormsecurity.com. It is declared as attacked. The vulnerability was handled as a non-public zero-day exploit for at least 5 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 277615 (Paessler PRTN Network Monitor < 18.2.39 Multiple Vulnerabilities), which helps to determine the existence of the flaw in a target environment. The commercial vulnerability scanner Qualys is able to test this issue with plugin 13436 (PRTG Network Monitor Command Injection Vulnerability). The CISA Known Exploited Vulnerabilities Catalog lists this issue since 02/04/2025 with a due date of 02/25/2025:

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Upgrading to version 18.2.39 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (277615). Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Network Management Software

Name

• PRTG Network Monitor

Version

• 18.2.0
• 18.2.1
• 18.2.2
• 18.2.3
• 18.2.4
• 18.2.5
• 18.2.6
• 18.2.7
• 18.2.8
• 18.2.9
• 18.2.10
• 18.2.11
• 18.2.12
• 18.2.13
• 18.2.14
• 18.2.15
• 18.2.16
• 18.2.17
• 18.2.18
• 18.2.19
• 18.2.20
• 18.2.21
• 18.2.22
• 18.2.23
• 18.2.24
• 18.2.25
• 18.2.26
• 18.2.27
• 18.2.28
• 18.2.29
• 18.2.30
• 18.2.31
• 18.2.32
• 18.2.33
• 18.2.34
• 18.2.35
• 18.2.36
• 18.2.37
• 18.2.38

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion