erroneo.us
Search all guides⌘K

Digest · Wednesday

Security digest: April 11, 2018

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: Paessler PRTG CVE-2018-19410 and 9276: Admin Takeover to RCE. Anyone running PRTG Network Monitor older than 18.2.41.1652, especially if its web interface is reachable from the internet or from untrusted networks.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2018-19410, CVE-2018-9276

Paessler PRTG CVE-2018-19410 and 9276: Admin Takeover to RCE

Both bugs were fixed in 2018 builds, so a maintained PRTG server is safe; the risk is a forgotten 2018-era install reachable from the network, where an outsider can add an admin and then run commands on the server.

Must act: Anyone running PRTG Network Monitor older than 18.2.41.1652, especially if its web interface is reachable from the internet or from untrusted networks.

Can relax: Teams on any PRTG release from mid-2018 onward that keep auto-update on and do not expose the web interface publicly.

  1. Find every PRTG core server, including lab and branch installs, and record the version shown in its web interface.
  2. Upgrade anything older than 18.2.41.1652 straight to the current stable release; do not stop at a 2018 build.
  3. Remove direct internet access to the PRTG web interface; put it behind a VPN or an IP allowlist.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.