An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
References
| Link | Resource |
|---|---|
| http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html | Exploit Mitigation Third Party Advisory VDB Entry |
| http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html | Exploit Third Party Advisory VDB Entry |
| http://www.securityfocus.com/archive/1/542103/100/0/threaded | Broken Link Third Party Advisory VDB Entry |
| https://www.exploit-db.com/exploits/46527/ | Exploit Third Party Advisory VDB Entry |
Configurations
Configuration 1 (hide)
|
History
25 Apr 2023, 15:41
| Type | Values Removed | Values Added |
|---|---|---|
| References | (BUGTRAQ) http://www.securityfocus.com/archive/1/542103/100/0/threaded - Broken Link, Third Party Advisory, VDB Entry |
12 Apr 2021, 13:42
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:* |
28 Jan 2021, 18:09
| Type | Values Removed | Values Added |
|---|---|---|
| References | (MISC) http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html - Exploit, Third Party Advisory, VDB Entry |
28 Jan 2021, 16:15
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2018-07-02 16:29
Updated : 2023-12-10 12:30
NVD link : CVE-2018-9276
Mitre link : CVE-2018-9276
CVE.ORG link : CVE-2018-9276
JSON object : View
Products Affected
paessler
- prtg_network_monitor
CWE
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')