CVE-2023-32781

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 14.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2023-08-09 · updated 2026-06-17
Weakness: CWE-77

Description

A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

Paessler PRTG: before 23.3.86.1520 — fixed in 23.3.86.1520

How to fix

Upgrade to a fixed version: Paessler PRTG 23.3.86.1520. Check the vendor advisory for mitigations.

References

http://packetstormsecurity.com/files/176677/PRTG-Authenticated-Remote-Code-Execution.html
https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520
https://www.paessler.com/prtg/history/stable
http://packetstormsecurity.com/files/176677/PRTG-Authenticated-Remote-Code-Execution.html
https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520
https://www.paessler.com/prtg/history/stable

Get alerted when CVE-2023-32781 or the next vulnerability affects your stack