Paessler PRTG Network Monitor up to 25.4.114 Web Interface welcome.htm cross site scripting

Summaryinfo

A vulnerability was found in Paessler PRTG Network Monitor. It has been declared as problematic. This vulnerability affects unknown code of the file welcome.htm of the component Web Interface. Executing a manipulation can lead to cross site scripting. The identification of this vulnerability is CVE-2026-4637. The attack may be launched remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Paessler PRTG Network Monitor and classified as problematic. This vulnerability affects some unknown processing of the file welcome.htm of the component Web Interface. The manipulation with an unknown input leads to a cross site scripting vulnerability. The CWE definition for the vulnerability is CWE-79. The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. As an impact it is known to affect integrity. CVE summarizes:

Paessler PRTG Network Monitor before version 26.2.120.1449 is affected by a reflected Cross-Site Scripting (XSS) vulnerability. When a request is made for a non-existent resource ending in \".htm\", the web interface returns an HTTP 403 \"Forbidden Path\" error page that echoes the requested URL path into the HTML response body without proper output encoding or sanitization. An unauthenticated, remote attacker can craft a URL containing an HTML/JavaScript payload in the path (e.g. https:////welcome.htm) and, once a victim with an active PRTG session opens the crafted link, execute arbitrary JavaScript in the security context of the PRTG web interface. Because the PRTG session cookie is not protected with the HttpOnly attribute, successful exploitation allows the attacker to read and exfiltrate the victim's session cookie, potentially leading to session hijacking.

The advisory is shared for download at paessler.freshdesk.com. This vulnerability was named CVE-2026-4637 since 03/23/2026. The exploitation appears to be easy. The attack can be initiated remotely. Successful exploitation requires user interaction by the victim. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1059.007.

By approaching the search of inurl:welcome.htm it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 26.2.120.1449 eliminates this vulnerability.

Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Network Management Software

Vendor

• Paessler

Name

• PRTG Network Monitor

Version

• 17.2.32.2279
• 17.3.33.2654
• 17.3.33.2830
• 18.1.39.1648
• 23.1.82
• 23.2.83.1760
• 23.3.86.1520
• 23.4.88.1429
• 25.4.114

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion