{"id":"CVE-2018-9276","kind":"vulnerability","aliases":["CVE-2018-9276"],"related":[],"title":"paessler prtg network monitor: An issue was discovered in PRTG Network Monitor before 18.2.39","description":"An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.","summary":"Paessler PRTG Network Monitor has an OS command injection flaw in its System Administrator web console. An attacker with administrative access can run arbitrary operating system commands on the host.","severity":"critical","cvss":9.0,"epss":null,"exploited":true,"exploited_at":"2025-02-04T00:00:00+00:00","products":[{"name":"paessler prtg network monitor","fixed":["18.2.39"],"affected":"< 18.2.39","ecosystem":"vendor"},{"name":"paessler prtg network monitor","fixed":["21.2.68"],"affected":"> 19.3.52, < 21.2.68","ecosystem":"vendor"},{"name":"Paessler PRTG Network Monitor","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","paessler-prtg","self-hosted","windows"],"not_affected_if":["no-admin-console-exposure"],"how_to_check":null,"fix":"Apply the vendor mitigations per Paessler instructions, or discontinue use of PRTG if mitigations are unavailable (per CISA KEV required action).","status":"open","published_at":"2018-07-02T16:29:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:52:38+00:00","updated_at":"2026-10-24T00:09:50+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:52:38Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per Paessler instructions, or discontinue use of PRTG if mitigations are unavailable (per CISA KEV required action).","reach":"network","impact":"high","summary":"Paessler PRTG Network Monitor has an OS command injection flaw in its System Administrator web console. An attacker with administrative access can run arbitrary operating system commands on the host.","category":"infrastructure","who_cares":["paessler-prtg","self-hosted","windows"],"confidence":0.6,"needs_auth":"yes","worst_case":"Admin attacker runs arbitrary OS commands on the PRTG server host.","analyst_note":"Sources do not name affected or fixed versions or give a check; find the vendor advisory from Paessler and the affected version range.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-admin-console-exposure"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000438,"input_tokens":2646,"output_tokens":346,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2018':16A,19A '-9276':17A,20A '18.2.39':14A,81C 'access':62B,86C 'administr':55B,61B,91C,95C 'arbitrari':65B 'attack':59B,83C 'command':49B,68B,101C 'consol':57B,93C 'cve':15A,18A 'devic':110C 'discov':8A,75C 'exploit':33B,98C 'flaw':51B 'host':40B,71B 'infrastructur':34B 'inject':50B,102C 'issu':6A,73C 'malform':113C 'manag':119C 'monitor':4A,12A,24A,28A,32A,45B,79C 'network':3A,11A,23A,27A,31A,44B,78C 'notif':118C 'oper':66B 'os':48B,100C 'paessler':1A,21A,25A,29A,36B,42B 'paessler-prtg':35B 'paramet':114C 'privileg':96C 'prtg':2A,10A,22A,26A,30A,37B,43B,77C,89C 'run':64B 'scenario':120C 'self':39B 'self-host':38B 'send':112C 'sensor':116C 'server':107C 'system':54B,67B,90C 'vulner':103C 'web':56B,92C 'window':41B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-07-02T16:29:00+00:00","kev":{"dateAdded":"2025-02-04","dueDate":"2025-02-25","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-9276","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-9276","severity":null,"published_at":"2025-02-04T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T17:39:56+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-9276","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9276","severity":null,"published_at":"2018-07-02T16:29:00+00:00","modified_at":"2026-06-17T02:06:20+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}