{"id":"CVE-2018-9276","published":"2018-07-02T16:29:00Z","modified":"2026-06-17T02:06:20Z","title":"Paessler PRTG Network Monitor OS Command Injection Vulnerability","vendor":"Paessler","product":"PRTG Network Monitor","tier":"core","eol":null,"description":{"text":"An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.","provenance":"source","from":"NVD"},"summary":{"text":"Paessler PRTG Network Monitor (versions before 18.2.39) contains an OS command injection flaw in its sensor and notification management functionality, affecting both the server and monitored devices. An attacker who can reach the PRTG System Administrator web console and holds administrative privileges can trigger it by sending malformed parameters during sensor or notification management operations, with no user interaction required.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-31T05:10:10Z"},"cvss":{"score":7.2,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.86996,"percentile":0.99747,"date":"2026-10-30","provenance":"source"},"kev":{"dateAdded":"2025-02-04","dueDate":"2025-02-25","ransomware":false,"requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","notes":"https://www.paessler.com/prtg/history/prtg-18#18.2.39 ; https://nvd.nist.gov/vuln/detail/CVE-2018-9276","provenance":"source"},"vulncheckKev":{"dateAdded":"2025-02-04","exploitedFirstSeen":"2025-02-04","ransomware":false,"evidence":[{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2025-02-04"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":2,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-78","name":"Improper Neutralization of Special Elements used in an OS Command"}],"references":[{"url":"http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html","tags":["Exploit","Mitigation","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/542103/100/0/threaded","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46527/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html","tags":["Exploit","Mitigation","Third Party Advisory","VDB Entry"]},{"url":"http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"http://www.securityfocus.com/archive/1/542103/100/0/threaded","tags":["Broken Link","Third Party Advisory","VDB Entry"]},{"url":"https://www.exploit-db.com/exploits/46527/","tags":["Exploit","Third Party Advisory","VDB Entry"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-9276","tags":["US Government Resource"]}],"techniques":[{"id":"T1078","name":"Valid Accounts","tactics":["initial-access","persistence","privilege-escalation","stealth"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: requires valid administrative credentials","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"who has access to the PRTG System Administrator web console with administrative privileges","start":76,"end":166}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"},{"id":"T1059","name":"Command and Scripting Interpreter","tactics":["execution"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: OS command injection enables command execution","mappingType":"primary_impact","evidence":[{"from":"description","quote":"can exploit an OS command injection vulnerability (both on the server and on devices)","start":167,"end":252}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2018-20870","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-20870","exploited":true,"exploitedSince":"2025-02-04","provenance":"source"},"exploits":[{"id":46527,"url":"https://www.exploit-db.com/exploits/46527","title":"PRTG Network Monitor 18.2.38 - (Authenticated) Remote Code Execution","type":"webapps","platform":"windows","date":"2019-03-11","verified":false,"provenance":"source"}],"exploitSources":{"exploitdb":{"count":1,"earliest":"2019-03-11"},"pocGithub":{"count":4,"skipped":1,"earliest":"2019-03-31","earliestUrl":"https://github.com/wildkindcc/CVE-2018-9276","repos":[{"name":"wildkindcc/CVE-2018-9276","url":"https://github.com/wildkindcc/CVE-2018-9276","stars":36,"created":"2019-03-31"},{"name":"alvinsmith-eroad/CVE-2018-9276","url":"https://github.com/alvinsmith-eroad/CVE-2018-9276","stars":0,"created":"2021-07-29"},{"name":"AC8999/PRTG-Network-Monitor-18.2.38---Authenticated-Remote-Code-Execution-CVE-2018-9276","url":"https://github.com/AC8999/PRTG-Network-Monitor-18.2.38---Authenticated-Remote-Code-Execution-CVE-2018-9276","stars":0,"created":"2026-04-07"},{"name":"BardLaudian/CVE-2018-9276","url":"https://github.com/BardLaudian/CVE-2018-9276","stars":0,"created":"2026-06-13"}]},"metasploit":[{"name":"PRTG Network Monitor Authenticated RCE","module":"exploit/windows/http/prtg_authenticated_rce","type":"exploit","disclosureDate":"2018-06-25","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/prtg_authenticated_rce.rb"}],"first":{"date":"2018-06-25","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/prtg_authenticated_rce.rb"},"provenance":"source"},"exploitRefs":["http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.html","http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.html","https://www.exploit-db.com/exploits/46527/"],"flow":[{"stage":"exploitation","techniques":["T1078"],"provenance":"ai"},{"stage":"primary","techniques":["T1059"],"provenance":"ai"}],"timeline":[{"date":"2018-06-25","kind":"exploit-public","label":"First public exploit: Metasploit; later: Exploit-DB 2019-03-11, PoC-in-GitHub 2019-03-31","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/windows/http/prtg_authenticated_rce.rb","provenance":"source"},{"date":"2018-07-02","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-9276","provenance":"source"},{"date":"2025-02-04","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","provenance":"source"},{"date":"2025-02-04","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2025-02-04","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2018-20870","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":"Metasploit","daysToKev":2409},"priority":{"score":68.0,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 634 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9975"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 NVD references tagged Exploit; 1 Exploit-DB entry; 4 PoC-in-GitHub repos; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":5.04,"detail":"base score 7.2"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}