Detections
Analytics

Paessler PRTN Network Monitor < 18.2.39 Multiple Vulnerabilities

high Nessus Plugin ID 277615

Language:

Synopsis

The remote host is missing a security update.

Description

The version of Paessler PRTG Network Monitor installed on the remote host is prior to 18.2.39. It is, therefore, affected by multiple vulnerabilities:

 - An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
 (CVE-2018-9276)

 - A potential security issue with sample custom notifications. (CVE-2018-9278)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Solution

Upgrade to Paessler PRTG Network Monitor version 18.2.39 or later.

See Also

http://www.nessus.org/u?8b502e62

Plugin Details

Severity: High

ID: 277615

File Name: paessler_prtg_network_monitor_18_2_39.nasl

Version: 1.2

Type: local

Agent: windows

Family: Windows

Published: 12/8/2025

Updated: 12/17/2025

Supported Sensors: Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: High

Score: 8.4

CVSS v2

Risk Factor: High

Base Score: 9

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C

CVSS Score Source: CVE-2018-9276

CVSS v3

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.7

Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:paessler:prtg_network_monitor

Required KB Items: SMB/Registry/Enumerated, installed_sw/Paessler PRTG Network Monitor

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 4/20/2018

Vulnerability Publication Date: 4/20/2018

CISA Known Exploited Vulnerability Due Dates: 2/25/2025

Exploitable With

Metasploit (PRTG Network Monitor Authenticated RCE)

Reference Information

CVE: CVE-2018-9276, CVE-2018-9278