Information Disclosure Vulnerability in PRTG Network Monitor by Paessler AG
CVE-2020-11547

5.3MEDIUM

Key Information:

Vendor

Paessler

Status
Prtg Network Monitor
Vendor
CVE Published:
5 April 2020

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 52%

What is CVE-2020-11547?

An information disclosure vulnerability exists in PRTG Network Monitor prior to version 20.1.57.1745, allowing remote unauthenticated attackers to gather sensitive system information. By crafting specific HTTP requests to the application, attackers can reveal critical metrics, such as CPU usage, memory utilization, operating system version, and other internal statistics of the monitoring tools. Such exposure can lead to further exploitation or reconnaissance activities, emphasizing the importance of timely updates and security configurations.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure
Created by ch-rigu

References

https://github.com/ch-rigu/PRTG-Network-Monitor-Informati...
x_refsource_MISC

EPSS Score

52% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

.