CVE-2023-32781
A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 14.3%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 14.26% probability · 96th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77
- Affected
- paessler/prtg network monitor
- Source
- cve@mitre.org
References
- http://packetstormsecurity.com/files/176677/PRTG-Authenticated-Remote-Code-Execution.html
- https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520Vendor Advisory
- https://www.paessler.com/prtg/history/stableRelease Notes
- http://packetstormsecurity.com/files/176677/PRTG-Authenticated-Remote-Code-Execution.html
- https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520Vendor Advisory
- https://www.paessler.com/prtg/history/stableRelease Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.