CVE-2018-9276

Paessler PRTG Network Monitor OS Command Injection Vulnerability

Paessler PRTG Network Monitor

CVSS

7.2High

ExploitationExploited in the wildAdded to KEV 4 Feb 2025CISA KEV

Exploit odds (EPSS)87.0%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS

Fixed inNone listedNo source names a fixed version yet

Federal deadline25 Feb 2025Remediation due date for US federal agenciesCISA KEV

CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

No source in this snapshot names a fixed version.

Timeline

25 Jun 2018Exploit code publicMetasploit
2 Jul 2018, 16:00 UTCPublishedCVE List
4 Feb 2025Added to CISA KEVCISA KEV

Public exploit code and templates 2

Exploit modulePRTG Network Monitor Authenticated RCE 25 Jun 2018Metasploit
Webapps exploitPRTG Network Monitor 18.2.38 - (Authenticated) Remote Code Execution 11 Mar 2019Exploit-DB

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.

Text from CVE List

Affected versions 1

n/aaffected: n/aCVE List