OS Command Injection Vulnerability in PRTG Network Monitor by Paessler AG
CVE-2018-9276

7.2HIGH

Key Information:

Vendor: Paessler
Status: Prtg Network Monitor
Vendor: CVE Published:; 2 July 2018

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 86%🦅 CISA Reported

What is CVE-2018-9276?

A security vulnerability exists in PRTG Network Monitor prior to version 18.2.39 that allows attackers with administrative access to exploit an OS command injection flaw. By submitting malformed parameters during sensor or notification management operations, an attacker can execute commands on both the server and any connected devices, potentially leading to unauthorized control and data breaches.

CISA has reported CVE-2018-9276

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2018-9276 as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2018-9276 - Proof of Concept

CVE-2018-9276
Created by wildkindcc

CVE-2018-9276
Created by A1vinSmith