CVE-2018-9276
- State
- Published
- Severity
- 7.2 High
- Published
- Jul 2, 2018
- Updated
- Oct 21, 2025
- Reserved
- Apr 4, 2018
Description
An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 7.2 High | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html
- 46527exploit
- 20180626 PRTG < 18.2.39 Command Injectionmailing-list
- http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-9276government-resource
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.