CVE-2018-9276
Paessler PRTG Network Monitor OS Command Injection Vulnerability
Description
CVE-2018-9276 is a high-severity OS command injection vulnerability in Paessler PRTG Network Monitor that allows an authenticated attacker with administrative privileges to execute arbitrary operating system commands on both the server and monitored devices. With a CVSS v3.1 base score of 7.2, the flaw exists in the sensor and notification management functionality, where malformed parameters are not properly sanitized before being passed to system commands. CISA has added this vulnerability to the Known Exploited Vulnerabilities (KEV) catalog with a remediation deadline of February 25, 2025, and the ransomware association is currently classified as unknown. The EPSS score of 81.54% at the 99.2nd percentile indicates extremely high exploitation probability, confirming widespread active exploitation in the wild.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| paessler | prtg network monitor | < 18.2.39; > 19.3.52, < 21.2.68 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
References
- http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html(Exploit, Mitigation, Third Party Advisory, VDB Entry)
- http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html(Exploit, Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/archive/1/542103/100/0/threaded(Broken Link, Third Party Advisory, VDB Entry)
- https://www.exploit-db.com/exploits/46527/(Exploit, Third Party Advisory, VDB Entry)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-9276(US Government Resource)
Weakness Type
Unknown CWE
CVE-2018-9276 does not have an officially assigned CWE in the NVD database, but the vulnerability is clearly an OS command injection flaw. The vulnerability allows authenticated administrators to inject arbitrary OS commands through the sensor and notification management interfaces of PRTG Network Monitor. When configuring sensors or notifications, certain parameters are passed directly to system shell commands without adequate input sanitization or parameterization. An attacker with administrative access can craft malformed parameter values containing shell metacharacters and command separators to execute arbitrary commands on the underlying operating system. This is a classic command injection pattern where user-controlled input is concatenated into shell commands rather than being properly escaped or passed through safe execution mechanisms. Learn more about OS Command Injection
Impact Analysis
The impact of CVE-2018-9276 is severe across all three dimensions of the CIA triad, each rated as high. Confidentiality is fully compromised because OS-level command execution on the PRTG server provides access to all data stored on the system, including the PRTG configuration database containing credentials for all monitored devices, SNMP community strings, WMI passwords, database connection strings, and any other secrets configured in the monitoring platform.
Integrity suffers maximum impact as arbitrary command execution enables the attacker to modify files, install backdoors, alter system configurations, manipulate monitoring data to conceal ongoing attacks, and pivot to other systems on the network using credentials harvested from PRTG. The ability to execute commands on monitored devices (in addition to the server) extends the integrity impact across the entire monitored infrastructure.
Availability is critically threatened because OS command execution provides unlimited capability to disrupt services, delete data, deploy ransomware, or render the monitoring system and connected devices inoperable. The EPSS score of 81.54% at the 99.2nd percentile confirms extremely active exploitation. Multiple public exploits are available, including on Packet Storm Security and Exploit-DB. While the vulnerability requires administrative authentication (PR:H), compromised admin credentials from CVE-2018-19410 or default/weak passwords make this a frequently chained exploitation target. The vulnerability affects PRTG versions before 18.2.39 and versions between 19.3.52 and 21.2.68.
Exploit Maturity
CVE-2018-9276 demonstrates maximum exploit maturity with multiple public exploits available and active exploitation confirmed through its inclusion in CISA's Known Exploited Vulnerabilities catalog with a remediation deadline of February 25, 2025. The EPSS score of 81.54% at the 99.2nd percentile reflects pervasive exploitation activity. Public exploit code is available from multiple sources including Packet Storm Security (2018), Packet Storm Security (2021 - Remote Code Execution), and Exploit-DB.
The availability of weaponized exploit code makes this vulnerability trivially exploitable by anyone with administrative access to a vulnerable PRTG instance. The exploit is frequently chained with CVE-2018-19410, which provides unauthenticated administrative access, creating a full remote code execution chain that requires no credentials at all. The CISA KEV entry can be reviewed at the KEV catalog. Despite being disclosed in 2018, the continued KEV listing in 2025 indicates that unpatched PRTG instances remain accessible and are actively targeted. The ransomware association is unknown, but the combination of easy exploitation and OS-level command execution makes this an attractive target for ransomware operators seeking initial access through network monitoring infrastructure.
Remediation
-
Upgrade PRTG Network Monitor to the latest available version immediately. The vulnerability affects versions before 18.2.39 and versions between 19.3.52 and 21.2.68. Ensure your installation is patched beyond version 21.2.68 to address this and any subsequently discovered vulnerabilities.
-
Restrict administrative access to PRTG by enforcing strong, unique passwords for all administrator accounts and enabling multi-factor authentication where supported. Review the list of administrator accounts and remove any that are unnecessary. Never use default credentials for the PRTG admin account.
-
Isolate the PRTG server network segment so that the management interface is only accessible from dedicated management networks. Configure firewall rules to prevent direct internet access to PRTG and restrict administrative access to specific jump hosts or VPN connections used by authorized administrators.
-
Monitor PRTG server processes for unexpected command execution by deploying endpoint detection and response (EDR) agents on the PRTG server. Alert on unusual child processes spawned by the PRTG service, particularly shell interpreters (cmd.exe, powershell.exe) or network utilities (certutil, bitsadmin, curl) that could indicate exploitation.
-
Audit sensor and notification configurations for any malicious entries that may have been created through exploitation. Review all custom sensors, notification scripts, and scheduled tasks configured in PRTG for injected commands or suspicious parameters. Reset any configurations that appear tampered with.
Technical Details
CVE-2018-9276 is an OS command injection vulnerability in Paessler PRTG Network Monitor, characterized by the CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H. Breaking down the vector components: Attack Vector (AV:N) indicates the vulnerability is exploitable over the network through the PRTG web interface. Attack Complexity (AC:L) means the exploit works reliably without special conditions. Privileges Required (PR:H) indicates the attacker needs administrative privileges to access the vulnerable sensor and notification management functions. User Interaction (UI:N) confirms no victim action is needed. Scope (S:U) indicates the impact stays within the PRTG server's security context, though OS command execution effectively provides full system control.
The command injection occurs in PRTG's sensor and notification management interfaces. When an administrator configures certain sensor types or notification actions, the input parameters are incorporated into operating system commands that PRTG executes to perform monitoring tasks. The vulnerable code paths fail to properly sanitize or escape special characters in user-supplied parameter values before passing them to command shell invocations. By injecting shell metacharacters such as semicolons, pipes, backticks, or command substitution sequences into the parameter values, an attacker can append arbitrary commands that execute with the privileges of the PRTG service account. Since PRTG typically runs with elevated privileges to perform network monitoring, the injected commands execute with correspondingly high system privileges. The vulnerability affects both server-side operations and commands executed on remote monitored devices, extending the attack surface beyond just the PRTG server itself.
Frequently Asked Questions
What is CVE-2018-9276?
CVE-2018-9276 is a high-severity OS command injection vulnerability in Paessler PRTG Network Monitor that allows authenticated administrators to execute arbitrary operating system commands on the PRTG server and monitored devices. It carries a CVSS score of 7.2 and is listed in CISA's KEV catalog.
Does CVE-2018-9276 require authentication?
Yes, CVE-2018-9276 requires administrative privileges to exploit directly. However, it is frequently chained with CVE-2018-19410, which allows unauthenticated attackers to create admin accounts, effectively enabling full remote code execution without any credentials.
Are there public exploits available for CVE-2018-9276?
Yes, multiple public exploits are available on Packet Storm Security and Exploit-DB. The availability of weaponized exploit code makes this vulnerability trivially exploitable once administrative access is obtained.
Which PRTG versions are affected by CVE-2018-9276?
The vulnerability affects PRTG Network Monitor versions before 18.2.39 and versions between 19.3.52 and 21.2.68. Organizations should upgrade to the latest PRTG version to ensure full protection.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.