CVE-2023-32782
A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 56.2%, higher than 99% of all known CVEs. Patch or mitigate before the next change window.
Description
A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS 3.1
- 7.2 HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- EPSS
- 56.16% probability · 99th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-77
- Affected
- paessler/prtg network monitor
- Source
- cve@mitre.org
References
- https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520Vendor Advisory
- https://www.paessler.com/prtg/history/stableRelease Notes
- https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520Vendor Advisory
- https://www.paessler.com/prtg/history/stableRelease Notes
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.