Paessler · PRTG Network Monitor
CVE-2018-19410
Paessler PRTG Network Monitor Local File Inclusion Vulnerability
What it is
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
CISA: Paessler PRTG Network Monitor contains a local file inclusion vulnerability that allows a remote, unauthenticated attacker to create users with read-write privileges (including administrator).
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: February 25, 2025
- Added to the CISA list
- February 4, 2025
- Published
- November 21, 2018
- Severity
- Critical 9.8 CVSS 3.1
- Chance of attacks in the next 30 days (EPSS)
- 98% in the top 0.1% of all known vulnerabilities
- More details
- NVD · CVE.org · CISA
All references (1)
More exploited flaws from Paessler
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Feb 4, 2025 | OS Command Injection | PRTG Network Monitor | High 7.2 | 87% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.