CVE-2018-9276

· HIGHAnalyzed

← All CVEs

CVSS v3.1

7.2

EPSS

87.17%

Published

Jul 2, 2018

Modified

Nov 6, 2025

CISA Known Exploited Vulnerability

Added: 2025-02-04 · Due: 2025-02-25

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Public PoC / Exploit (7)

All weaponized →

Exploit-DBPRTG Network Monitor 18.2.38 - (Authenticated) Remote Code Execution TrickestTrickest PoC index GitHub PoCwildkindcc/CVE-2018-9276★36 GitHub PoCandyfeili/CVE-2018-9276★0 GitHub PoCalvinsmith-eroad/CVE-2018-9276★0 GitHub PoCAC8999/PRTG-Network-Monitor-18.2.38---Authenticated-Remote-Code-Execution-CVE-2018-9276★0 GitHub PoCBardLaudian/CVE-2018-9276★0

Links to public security research (Exploit-DB, Nuclei, Trickest, GitHub) for defensive use only.

Description

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-78CWE-78

Affected Products (2)

paessler · prtg_network_monitor (up to 18.2.39)vulnerable

paessler · prtg_network_monitor (up to 21.2.68)vulnerable

References (9)

http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html

ExploitMitigationThird Party Advisory

http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html

ExploitThird Party AdvisoryVDB Entry