CVE-2018-19204

    Dashboard / Vulnerabilities / CVE-2018-19204

    CVE-2018-19204

    Published: 12 Nov 2018Last Modified: 10 Mar 2026

    Summary:

    Details: PRTG Network Monitor before 18.3.44.2054 allows a remote authenticated attacker (with read-write privileges) to execute arbitrary code and OS commands with system privileges. When creating an HTTP Advanced Sensor, the user's input in the POST parameter 'proxyport_' is mishandled. The attacker can craft an HTTP request and override the 'writeresult' command-line parameter for HttpAdvancedSensor.exe to store arbitrary data in an arbitrary place on the file system. For example, the attacker can create an executable file in the \Custom Sensors\EXE directory and execute it by creating EXE/Script Sensor.

    References: , https://www.ptsecurity.com/ww-en/analytics/threatscape/pt-2018-23/, http://en.securitylab.ru/lab/PT-2018-23, https://www.paessler.com/prtg/history/stable#18.3.44.2054

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High