What’s Vulnerable › Vulnerabilities

CVE-2018-9276: Paessler PRTG Network Monitor OS Command Injection Vulnerability

• Severity: high (CVSS 7.2 v3.1)
• Exploited in the wild: yes — in CISA KEV since 2025-02-04
• EPSS: 87.0% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2018-07-02 · updated 2026-06-17
• Weakness: CWE-78

Description

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.

Affected products

• Paessler PRTG: before 18.2.39; from 19.3.52 (excl.) before 21.2.68 — fixed in 18.2.39, 21.2.68

How to fix

Upgrade to a fixed version: Paessler PRTG 18.2.39, 21.2.68. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html
• http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html
• http://www.securityfocus.com/archive/1/542103/100/0/threaded
• https://www.exploit-db.com/exploits/46527/
• http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html
• http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html
• http://www.securityfocus.com/archive/1/542103/100/0/threaded
• https://www.exploit-db.com/exploits/46527/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-9276

Get alerted when CVE-2018-9276 or the next vulnerability affects your stack