Paessler PRTG Network Monitor up to 25.4.114 Demo Sensor windowspassword information disclosure

Summaryinfo

A vulnerability was found in Paessler PRTG Network Monitor. It has been rated as problematic. This issue affects some unknown processing of the component Demo Sensor. The manipulation of the argument windowspassword leads to information disclosure. This vulnerability is referenced as CVE-2026-4638. Remote exploitation of the attack is possible. No exploit is available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability was found in Paessler PRTG Network Monitor and classified as problematic. This issue affects an unknown function of the component Demo Sensor. The manipulation of the argument windowspassword with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter.  Any PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output.

The advisory is shared at r.sec-consult.com. The identification of this vulnerability is CVE-2026-4638 since 03/23/2026. The exploitation is known to be easy. The attack may be initiated remotely. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1592 for this issue.

Upgrading to version 26.2.120.1449 eliminates this vulnerability.

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Network Management Software

Vendor

• Paessler

Name

• PRTG Network Monitor

Version

• 17.2.32.2279
• 17.3.33.2654
• 17.3.33.2830
• 18.1.39.1648
• 23.1.82
• 23.2.83.1760
• 23.3.86.1520
• 23.4.88.1429
• 25.4.114

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Discussion