CVE-2018-19410
Paessler PRTG Network Monitor Local File Inclusion Vulnerability
Description
CVE-2018-19410 is a critical-severity vulnerability in Paessler PRTG Network Monitor before version 18.2.40.1683 that allows remote unauthenticated attackers to create users with read-write privileges, including administrator access. With a CVSS v3.1 base score of 9.8, the flaw enables attackers to craft HTTP requests that override attributes of the include directive in the public login page and perform a Local File Inclusion attack to execute the user creation API endpoint. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 25, 2025, and the ransomware association is currently classified as unknown. The EPSS score of 91.75% at the 99.7th percentile indicates near-certain exploitation probability, placing this vulnerability among the most actively exploited flaws in existence.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paessler | prtg network monitor | < 18.2.40.1683 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-24/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-19410(US Government Resource)
Weakness Type
No CWE Assigned
CVE-2018-19410 does not have a CWE formally assigned in the NVD database. However, the vulnerability combines elements of Local File Inclusion (LFI) and improper access control. The attack exploits the include directive mechanism in PRTG Network Monitor's public login page (/public/login.htm) to include internal API endpoints that should not be accessible to unauthenticated users. By manipulating HTTP request parameters, an attacker can override the attributes of the include directive to reference the /api/addusers endpoint, which is intended to be accessible only to authenticated administrators. The inclusion and execution of this endpoint with attacker-controlled parameters allows creation of new user accounts with full read-write and administrative privileges. This represents a severe authentication bypass that chains local file inclusion with privilege escalation. Learn more about Local File Inclusion
Impact Analysis
The impact of CVE-2018-19410 is catastrophic across all three dimensions of the CIA triad, each rated as high. Confidentiality is fully compromised because the attacker can create an administrator account and gain complete access to all network monitoring data managed by PRTG, including device configurations, SNMP community strings, WMI credentials, database connection strings, and any other sensitive information stored within the monitoring platform. PRTG typically has deep visibility into enterprise infrastructure, making this data treasure trove for attackers.
Integrity suffers maximum impact as administrative access to PRTG allows modification of all monitoring configurations, suppression of alerts that would normally detect malicious activity, creation of additional backdoor accounts, and manipulation of monitoring thresholds to mask ongoing attacks. The attacker can also modify notification triggers, scripts, and scheduled tasks within PRTG to establish persistent access or execute additional malicious commands.
Availability is critically threatened because an attacker with administrative control over the monitoring system can disable monitoring entirely, delete sensors and device configurations, or disrupt the organization's ability to detect and respond to infrastructure issues. The EPSS score of 91.75% at the 99.7th percentile confirms that this vulnerability is among the most exploited in the entire tracked vulnerability landscape. The network-accessible attack vector with no authentication required and low attack complexity makes this trivially exploitable by any attacker who can reach the PRTG web interface. Organizations running PRTG Network Monitor versions prior to 18.2.40.1683 should treat this as a maximum-priority remediation target.
Exploit Maturity
CVE-2018-19410 demonstrates maximum exploit maturity through its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 25, 2025. The EPSS score of 91.75% at the 99.7th percentile reflects near-universal exploitation activity, indicating this vulnerability is more actively exploited than 99.7% of all tracked vulnerabilities. The vulnerability was originally disclosed by Positive Technologies in their advisory PT-2018-24.
Despite being disclosed in 2018, the continued inclusion in the KEV catalog in 2025 indicates that vulnerable PRTG instances remain exposed on the internet and are actively being targeted. The attack requires no authentication, no user interaction, and can be executed with a single crafted HTTP request, making it ideal for automated scanning and exploitation. The ability to create administrative accounts provides immediate, persistent access to the compromised monitoring system. PRTG Network Monitor is widely deployed in enterprise environments for infrastructure monitoring, and exposed instances are routinely discovered through internet-wide scanning. The CISA KEV entry can be reviewed at the KEV catalog. The ransomware association is unknown, but administrative access to a monitoring platform provides attackers with comprehensive network visibility that enables lateral movement and targeted attacks.
Remediation
-
Upgrade PRTG Network Monitor to version 18.2.40.1683 or later immediately. This version addresses the Local File Inclusion vulnerability that enables unauthenticated user creation. Access the PRTG update mechanism through the administration interface or download the latest version from the Paessler website.
-
Audit existing PRTG user accounts for any unauthorized additions. Review the user list in Setup > System Administration > User Accounts and investigate any accounts that were not intentionally created by administrators. Pay particular attention to accounts with administrative privileges that were created around times when the system may have been exposed.
-
Restrict network access to the PRTG web interface to trusted management networks only. Place PRTG behind a VPN or firewall that limits access to the web console (default ports 80/443 and 8080/8443) to authorized administrator IP addresses. Never expose the PRTG management interface directly to the internet.
-
Rotate all credentials stored in PRTG if there is any possibility the system was compromised. This includes SNMP community strings, WMI credentials, database passwords, SSH keys, and any other authentication material configured in PRTG device and sensor settings, as an attacker with administrative access would have had full visibility into these credentials.
-
Implement network monitoring for PRTG API access by logging and alerting on requests to the /api/addusers endpoint and other administrative API endpoints from unexpected sources. Configure your web application firewall or reverse proxy to block unauthenticated requests to PRTG API endpoints.
Technical Details
CVE-2018-19410 is an unauthenticated user creation vulnerability in Paessler PRTG Network Monitor, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Breaking down the vector components: Attack Vector (AV:N) indicates the vulnerability is exploitable over the network without physical or local access. Attack Complexity (AC:L) means the exploit works reliably without any special conditions. Privileges Required (PR:N) confirms no authentication is needed to exploit the vulnerability. User Interaction (UI:N) indicates no victim action is required. Scope (S:U) means the impact stays within the PRTG application context, though administrative access to a monitoring system has cascading implications.
The attack exploits PRTG Network Monitor's server-side include mechanism in the login page. The public-facing /public/login.htm page uses an include directive to compose the page from multiple template components. An attacker can craft an HTTP request that overrides the attributes of this include directive, redirecting it to reference the internal /api/addusers API endpoint. By providing the required parameters — specifically the 'id' and 'users' parameters — within the same request, the server processes the include as an authenticated API call, creating new user accounts with the attacker-specified permissions. The fundamental flaw is that the include mechanism does not enforce access controls on the included resource, allowing an unauthenticated request to the login page to trigger execution of an administrative API that should require authentication. The vulnerability affects all PRTG Network Monitor versions prior to 18.2.40.1683.
Frequently Asked Questions
What is CVE-2018-19410?
CVE-2018-19410 is a critical vulnerability in Paessler PRTG Network Monitor that allows remote unauthenticated attackers to create new user accounts with full administrative privileges. It carries a CVSS score of 9.8 and has been added to CISA's KEV catalog.
How is CVE-2018-19410 exploited?
An attacker sends a crafted HTTP request to the PRTG login page that overrides the include directive to reference the internal user creation API endpoint. This causes the server to execute the administrative API without authentication, creating a new user account with attacker-specified privileges.
Which versions of PRTG are affected by CVE-2018-19410?
All versions of Paessler PRTG Network Monitor prior to version 18.2.40.1683 are vulnerable. Organizations should upgrade to this version or later to remediate the vulnerability.
Is CVE-2018-19410 being actively exploited?
Yes, CVE-2018-19410 is confirmed to be actively exploited in the wild. It is listed in CISA's Known Exploited Vulnerabilities catalog, and its EPSS score of 91.75% at the 99.7th percentile places it among the most actively exploited vulnerabilities globally.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.