CVE-2026-4638: Plaintext Password Disclosure via VBScript Sensor Error Message in Paessler PRTG Network Monitor
PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter.
Any PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Paessler PRTG Network Monitorto a version that resolves this vulnerability.Fixed in 26.2.120.1449
Event History
Frequently Asked Questions
Which users can exploit this issue?
Any PRTG user who is not restricted to read-only access and can create sensors can exploit it. Sensor creation is allowed by default for non-read-only users.
What does an attacker need to do to expose the password?
The attacker must create or configure the shipped demo EXE/Script sensor to pass %windowspassword as a non-numeric argument. This causes cscript.exe to raise a type-mismatch error that includes the resolved password in the sensor error output.
Are read-only PRTG users affected?
Read-only users are not described as able to exploit the issue, because exploitation requires permission to create sensors. Users with sensor-creation privileges should be reviewed.
What can be done before upgrading?
Restrict sensor-creation permissions to trusted administrators and avoid allowing use of the demo EXE/Script sensor with sensitive placeholder variables. Review existing sensor configurations and error output for use of %windowspassword or unexpected type-mismatch errors.