CVE-2018-9276
KEVPaessler PRTG Network Monitor OS Command Injection Vulnerability
Description
Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
CVSS 3.1 vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HPublishedJul 2, 2018
Last modifiedJun 17, 2026
Added to KEVFeb 4, 2025
Remediation dueFeb 25, 2025
References
- packetstormsecurity.com/files/148334/PRTG-Command-Injection.htmlExploitMitigation
- packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.htmlExploitThird Party Advisory
- securityfocus.com/archive/1/542103/100/0/threadedBroken LinkThird Party Advisory
- exploit-db.com/exploits/46527/ExploitThird Party Advisory
- cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-9276US Government Resource
0 recent articles mention this CVE
75
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 608 days
- CVSS
- 7.2 HIGH
- EPSS (30-day exploit probability)
- 87.0% · top 1% of all CVEs
- Weakness
- CWE-78
- Attack vector
- Network, remotely reachable
Recommended actions
- 1.Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Review exposure: confirm which instances are reachable from the internet and restrict access until patched.
- 4.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.