erroneo.us
Search all guides⌘K

Security Digest · Apr 11, 2018 · Vulnerability · Network edge

Paessler PRTG CVE-2018-19410 and 9276: Admin Takeover to RCE

Two 2018 PRTG Network Monitor bugs, fixed in 18.2.39 to 18.2.41, joined CISA KEV in Feb 2025. Confirm no old PRTG is exposed; hunt for rogue admin users.

Published By erroneo.us Security Desk · Updated 3 min read11 sources

Our verdict

Check exposure

Both bugs were fixed in 2018 builds, so a maintained PRTG server is safe; the risk is a forgotten 2018-era install reachable from the network, where an outsider can add an admin and then run commands on the server.

Who must act: Anyone running PRTG Network Monitor older than 18.2.41.1652, especially if its web interface is reachable from the internet or from untrusted networks.

Who can relax: Teams on any PRTG release from mid-2018 onward that keep auto-update on and do not expose the web interface publicly.

Affected
PRTG Network Monitor before 18.2.39 (CVE-2018-9276)
PRTG Network Monitor before 18.2.40.1683 per the CVE record; Paessler also lists the fix in 18.2.41.1652 (CVE-2018-19410)
Fixed in
PRTG 18.2.39.1661 (Apr 11, 2018) for CVE-2018-9276
PRTG 18.2.41.1652 (Jun 6, 2018) or later for CVE-2018-19410
Current stable: 26.3.124.1727 (Sep 16, 2026)
CVSS
9.8 (v3.1, CISA-ADP)
EPSS
97.9% (percentile 99.9)
CISA KEV
Yes, listed as known exploited
Exploitation
Exploited in the wild
Severity
Critical

What to do

  1. Find every PRTG core server, including lab and branch installs, and record the version shown in its web interface.
  2. Upgrade anything older than 18.2.41.1652 straight to the current stable release; do not stop at a 2018 build.
  3. Remove direct internet access to the PRTG web interface; put it behind a VPN or an IP allowlist.
  4. Confirm the built-in prtgadmin account no longer uses the default prtgadmin password.
  5. If an old build was ever exposed, rotate every credential PRTG stores for monitored devices.

How to check if you are affected or compromised

  • Review user accounts for administrators or read/write users nobody created.
  • Search the PRTG web server logs for requests to /public/login.htm that reference addusers.
  • Review notifications and EXE/Script sensors for unexpected Execute Program actions or script parameters.
  • Look for unknown scripts in the PRTG notifications folder and unexpected child processes of the PRTG services.

What happened#

PRTG Network Monitor is Paessler's Windows-based monitoring server. In 2018 Paessler fixed two bugs in its web interface that chain into full control of the server.

CVE-2018-9276 is an OS command injection. Josh Berry of CodeWatch reported it on February 14, 2018 and published details on June 25. The bundled demo PowerShell notification script did not sanitize its Parameter field, so an administrator could run arbitrary commands on the server. Paessler's version history lists the fix in 18.2.39, whose build 18.2.39.1661 shipped on April 11, 2018. It covered EXE/Script sensors and Execute Program notifications. CISA scores it CVSS 3.1 7.2.

CVE-2018-19410 removes the need for an admin login. The CVE record says an unauthenticated request can abuse the include directive in /public/login.htm to pull in /api/addusers. With the id and users parameters, that creates a read/write or administrator account. CISA scores it 9.8. The record names 18.2.40.1683 as the first fixed build. Paessler lists the CVE in its 18.2.39 notes and again in 18.2.41.1652 (June 6, 2018), where it credits Positive Technologies.

Together they give an outsider admin rights and then code execution. CISA added both to the KEV catalog on February 4, 2025, with a February 25 deadline.

Who is affected#

PRTG builds before 18.2.39 are open to the command injection (CVE record). Builds before 18.2.41.1652 should be treated as open to the account-creation bug. The current stable release is 26.3.124.1727, released September 16, 2026.

Do you really need to act?#

Only if an old PRTG server is still running. CISA did not say why it listed two 2018 bugs in 2025. The Hacker News noted at the time that there were "no public reports" about how they were exploited. No campaign report names them as of October 23, 2026. CrowdSec has tracked attempts against CVE-2018-19410 since May 28, 2025. It says they show up as requests to /public/login.htm.

A monitoring server is a valuable target. It stores credentials for the routers, servers and services it watches. Old installs also often keep the default prtgadmin/prtgadmin login, which Paessler's support article confirms. That makes CVE-2018-9276 reachable even without the first bug. A current, non-exposed PRTG server is not at risk from either CVE.

What to do now#

  1. List every PRTG core server, including lab and branch installs, and record the version shown in the web interface. Current servers can update through Setup | Auto Update.
  2. Upgrade anything older than 18.2.41.1652 to the current stable release. A 2018 build is missing years of later fixes.
  3. Take the web interface off the internet. Put it behind a VPN or an IP allowlist.
  4. Change the prtgadmin password if it is still the default.
  5. If an old build was ever exposed, rotate every device and service credential stored in PRTG.

How to tell if you were hit#

  • In PRTG's user account list, look for administrators or read/write users nobody created.
  • Search the web server logs. Paessler's data-folder article puts them in Logs\webserver under %programdata%\Paessler\PRTG Network Monitor, or Logs (Web Server) before 18.3.43. For example: findstr /s /i "addusers" "%programdata%\Paessler\PRTG Network Monitor\Logs\*.log".
  • Review notifications and EXE/Script sensors for Execute Program actions or parameters you did not set. Check the notifications script folder for files nobody put there.
  • If you find signs of compromise, treat the host and every credential it stored as compromised.

Timeline#

  • — Josh Berry reports the command injection to Paessler.
  • — PRTG 18.2.39.1661 ships with the CVE-2018-9276 fix.
  • — PRTG 18.2.40.1683 ships. The CVE record names it as the fix for CVE-2018-19410.
  • — PRTG 18.2.41.1652 ships. Its notes list CVE-2018-19410 again.
  • — Berry publishes CVE-2018-9276.
  • — CVE-2018-19410 is published.
  • — CISA adds both CVEs to KEV.
  • — CrowdSec starts tracking attempts against CVE-2018-19410.

Vulnerability records

  • CVE-2018-19410 · KEV 2025-02-04 · PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator).
  • CVE-2018-9276 · KEV 2025-02-04 · An issue was discovered in PRTG Network Monitor before 18.2.39.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

  1. Paessler — PRTG 18 version history (archived Nov 13, 2019) web.archive.org
  2. Paessler — PRTG stable release notes paessler.com
  3. Josh Berry (CodeWatch) — PRTG < 18.2.39 Command Injection (CVE-2018-9276), Bugtraq lists.openwall.net
  4. CVE record — CVE-2018-19410 cve.org
  5. CVE record — CVE-2018-9276 cve.org
  6. CISA — Known Exploited Vulnerabilities: CVE-2018-19410 cisa.gov
  7. CISA — Known Exploited Vulnerabilities: CVE-2018-9276 cisa.gov
  8. Paessler — What's the login name and password for the PRTG web interface? helpdesk.paessler.com
  9. Paessler — How and where does PRTG store its data? helpdesk.paessler.com
  10. CrowdSec — CVE-2018-19410 tracker tracker.crowdsec.net

Coverage and analysis

  1. The Hacker News — CISA Adds Four Actively Exploited Vulnerabilities to KEV Catalog, Urges Fixes by Feb 25 thehackernews.com