Actively exploited · Published Nov 21, 2018 · Assigned by mitre
CVE-2018-19410
Critical 9.8 Exploited
In plain English
A critical-severity security flaw in PRTG Network Monitor from Paessler. Attackers are actively exploiting it in the wild (listed by CISA on February 4, 2025). The chance it is exploited in the next 30 days is estimated at 97.9% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Feb 25, 2025.
Official description
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).