Description

PRTG Network Monitor before 23.1.82 allows remote attackers to write to files via the HTTP XML/REST Sensor.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "2.7",
  "pubDate": "2026-09-14T04:16:33.853Z",
  "pubdate": "2026-09-14T04:16:33.853Z",
  "executiveSummary": "A critical vulnerability exists in PRTG Network Monitor versions prior to 23.1.82, specifically within the HTTP XML/REST Sensor component.\nThe vulnerability is classified as an arbitrary file write, allowing unauthorized remote attackers to create or overwrite files on the host system.\nBy manipulating requests sent to the vulnerable sensor, an attacker can bypass standard file integrity controls to inject malicious content or configuration parameters into the system.\nThe impact of this vulnerability is significant, as it provides a pathway for remote code execution, persistence, or system disruption.\nSuccessful exploitation requires the attacker to have network access to the PRTG instance, enabling them to interact with the HTTP XML/REST sensor functionality.\nThis flaw poses a severe risk to the confidentiality, integrity, and availability of the affected PRTG deployment, as it circumvents expected input validation mechanisms during the data processing phase of the sensor's operation.",
  "technicalDetails": "The vulnerability resides in the HTTP XML/REST Sensor component of PRTG Network Monitor, which is designed to poll external resources and process XML-formatted data. The root cause is improper neutralization of input data during the sensor's handling of HTTP requests, failing to sanitize or restrict the file paths targeted by the sensor's operations.\nDuring normal operation, the HTTP XML/REST Sensor fetches data from a specified URL and processes the returned XML. Due to inadequate input validation, the application allows the specification of file paths that are not properly constrained to intended data directories.\nThe attack flow begins when an attacker identifies the HTTP XML/REST Sensor configuration endpoint. By manipulating the sensor parameters, the attacker can force the application to perform write operations to unauthorized locations on the underlying file system. When the sensor triggers, it processes the attacker-supplied XML or configuration payload, subsequently writing this content to the target file path defined in the manipulated request.\nBecause the PRTG service typically runs with elevated privileges, the file write operation is performed with the security context of the PRTG server process. This effectively grants the attacker the ability to overwrite critical system configuration files, inject scripts into web directories, or modify existing application binaries.\nExploitation is conducted remotely over the network. While the specific requirements for authentication may vary based on the deployment's configuration, the ability for remote, unauthenticated, or low-privileged actors to interact with the sensor polling functionality provides a large attack surface. The payload behavior involves the transmission of crafted data packets that bypass logical path restrictions, allowing the binary or text-based content to be persisted to the disk.\nPost-exploitation impact is severe, potentially leading to a full system compromise. Once the attacker has successfully written an arbitrary file, they can achieve remote code execution by placing a malicious payload in a location that the PRTG server or the operating system executes, such as an executable path, a configuration file that dictates system behavior, or an application web root accessible via the monitoring interface."
}