CVE-2018-9276

HighCVSS 7.2/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on the server and on devices) by sending malformed parameters in sensor or notification management scenarios.

Metrics

CVSS 3.1 7.2/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-78

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.htmlExploit, Mitigation, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/542103/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46527/Exploit, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/148334/PRTG-Command-Injection.htmlExploit, Mitigation, Third Party Advisory, VDB Entry
http://packetstormsecurity.com/files/161183/PRTG-Network-Monitor-Remote-Code-Execution.htmlExploit, Third Party Advisory, VDB Entry
http://www.securityfocus.com/archive/1/542103/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
https://www.exploit-db.com/exploits/46527/Exploit, Third Party Advisory, VDB Entry
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-9276US Government Resource

Timeline

Published: Jul 2, 2018
Last modified: Jun 17, 2026
Added to CISA KEV: Feb 4, 2025
NVD status: Analyzed

Related CVEs from 2018

CVE-2018-92794.9An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the user's password. The web page displayed by the applian CVE-2018-92804.9An issue was discovered on Eaton UPS 9PX 8000 SP devices. The appliance discloses the SNMP version 3 user's password. The web page displayed CVE-2018-92818.8An issue was discovered on Eaton UPS 9PX 8000 SP devices. The administration panel is vulnerable to a CSRF attack on the change-password fun CVE-2018-92826.1An XSS issue was discovered in Subsonic Media Server 6.1.1. The podcast subscription form is affected by a stored XSS vulnerability in the a CVE-2018-92835.4An XSS issue was discovered in CremeCRM 1.6.12. It is affected by 10 stored Cross-Site Scripting (XSS) vulnerabilities in the firstname, las CVE-2018-92849.8authentication.cgi on D-Link DIR-868L devices with Singapore StarHub firmware before v1.21SHCb03 allows remote attackers to execute arbitrar CVE-2018-92859.8Main_Analysis_Content.asp in /apply.cgi on ASUS RT-AC66U, RT-AC68U, RT-AC86U, RT-AC88U, RT-AC1900, RT-AC2900, and RT-AC3100 devices before 3 CVE-2018-93029.1SSRF (Server Side Request Forgery) in /assets/lib/fuc.js.php in Cockpit 0.4.4 through 0.5.5 allows remote attackers to read arbitrary files CVE-2018-93036.5In Exiv2 0.26, an assertion failure in BigTiffImage::readData in bigtiffimage.cpp results in an abort.CVE-2018-93046.5In Exiv2 0.26, a divide by zero in BigTiffImage::printIFD in bigtiffimage.cpp could result in denial of service.CVE-2018-93058.1In Exiv2 0.26, an out-of-bounds read in IptcData::printStructure in iptc.c could result in a crash or information leak, related to the "== 0 CVE-2018-93076.1dsmall v20180320 allows XSS via the pdr_sn parameter to public/index.php/home/predeposit/index.html.