Input Validation Flaw in PRTG Network Monitor Allows Arbitrary CSS Insertion

CVE-2022-35739

What is CVE-2022-35739?

PRTG Network Monitor, through version 22.2.77.2204, exhibits a vulnerability where it fails to properly validate custom input for device icons. This oversight enables an attacker to insert arbitrary Cascading Style Sheets (CSS) data into the device's style tag. As the device page loads, this malicious CSS can execute, potentially introducing harmful content. Although certain safeguards against character limitations and JavaScript support exist, the absence of adequate input filtering poses a risk by allowing the injection of unauthorized CSS.

References