CVE-2018-9276: Paessler PRTG Network Monitor OS Command Injection Vulnerability
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
Other sources
Paessler PRTG Network Monitor contains an OS command injection vulnerability that allows an attacker with administrative privileges to execute commands via the PRTG System Administrator web console.
— CISA
Affected Software
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is CVE-2018-9276?
CVE-2018-9276 is an OS command injection vulnerability in PRTG Network Monitor before 18.2.39.
What is the severity of CVE-2018-9276?
CVE-2018-9276 has a severity rating of 7.2 (critical).
How can an attacker exploit CVE-2018-9276?
An attacker with access to the PRTG System Administrator web console and administrative privileges can exploit the OS command injection vulnerability by sending malformed parameters in sensor or device requests.
Which versions of PRTG Network Monitor are affected by CVE-2018-9276?
PRTG Network Monitor versions before 18.2.39 and versions between 19.3.52 and 21.2.68 are affected by CVE-2018-9276.
How can I fix CVE-2018-9276?
To fix CVE-2018-9276, users should update to version 18.2.39 or newer, or version 21.2.68 or newer.