Paessler · PRTG Network Monitor

CVE-2018-9276

Paessler PRTG Network Monitor OS Command Injection Vulnerability

Exploited in attacks High 7.2 Attack chance: 87%

What it is

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.

CISA: Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.

What to do

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Deadline for US federal agencies: February 25, 2025

Added to the CISA list: February 4, 2025
Published: July 2, 2018
Severity: High 7.2 CVSS 3.1
Chance of attacks in the next 30 days (EPSS): 87% in the top 0.3% of all known vulnerabilities
Weakness: CWE-78
More details: NVD · CVE.org · CISA

All references (4)

More exploited flaws from Paessler

Added	Vulnerability	Product	Severity	Attack chance
Feb 4, 2025	Local File InclusionCVE-2018-19410	PRTG Network Monitor	Critical 9.8	98%

All of them →

Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.