An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html | Exploit Mitigation Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html | Exploit Third Party Advisory VDB Entry |
| http://www.securityfocus.com/archive/1/542103/100/0/threaded | Broken Link Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/46527/ | Exploit Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html | Exploit Mitigation Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html | Exploit Third Party Advisory VDB Entry |
| http://www.securityfocus.com/archive/1/542103/100/0/threaded | Broken Link Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/46527/ | Exploit Third Party Advisory VDB Entry |
| https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-9276 |
Configurations
Configuration 1 (hide)
|
History
22 Oct 2025, 00:16
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Oct 2025, 20:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
21 Oct 2025, 19:17
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2018-07-02 16:29
Updated : 2025-10-22 00:16
NVD link : CVE-2018-9276
Mitre link : CVE-2018-9276
CVE.ORG link : CVE-2018-9276
JSON object : View
Products Affected
paessler
- prtg_network_monitor
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')