CVE-2018-19410: Paessler PRTG Network Monitor Local File Inclusion Vulnerability

CVE-2018-19410 is a local file inclusion vulnerability in Paessler PRTG Network Monitor. It allows a remote, unauthenticated attacker to create users with read-write privileges, including administrator accounts. This matters because successful abuse can give an outsider full control of the monitoring platform, which often holds network credentials, device inventories, and configuration data that can be leveraged for further compromise.

Defenders should treat any exposed or internet-facing PRTG instance as high priority until the issue is confirmed remediated against the vendor advisory.

How it works

The flaw is described as a local file inclusion vulnerability. In this class of weakness, an attacker can cause the application to process or include a file from the local filesystem in a way the developers did not intend. According to the CISA summary, the practical outcome in PRTG Network Monitor is that a remote attacker who has not authenticated can create new user accounts that possess read-write rights, up to and including administrator-level privileges.

Exact request paths, parameters, or file targets are not provided in the available facts; those details must be confirmed against the vendor advisory. Once an attacker-controlled account exists, the adversary can log in, alter monitoring configurations, harvest stored credentials, or use the platform as a foothold inside the network.

Am I affected? How to find it in your systems

PRTG Network Monitor is typically deployed on Windows servers (or virtual machines) that collect metrics from network devices, servers, and applications. It is commonly found in network operations centers, managed-service-provider environments, and enterprise monitoring stacks.

• Inventory every host that runs the PRTG core server or probe software. Check installed programs, services named PRTG, listening ports associated with the product, and configuration directories.
• Identify the exact version and build of each installation and compare it with the fixed versions listed in the vendor advisory. Public detail on specific affected releases is limited here, so confirmation against the advisory is required.
• Review authentication and user-management logs for unexpected account creations, especially accounts that appear without corresponding administrative action or that are granted read-write or administrator rights.
• Look for anomalous web-server or application logs that show requests attempting to include or reference local files outside normal PRTG paths.
• If the PRTG web interface is reachable from untrusted networks, treat the instance as potentially exposed until proven otherwise.

How to remediate

Apply the vendor-supplied update that addresses CVE-2018-19410 as the primary remediation. Follow the installation and verification steps published by Paessler; the CISA required action is to apply mitigations per vendor instructions or to discontinue use of the product if mitigations are unavailable.

• After patching, verify that the installed version matches the fixed release and that the service restarts cleanly.
• Audit all existing user accounts and remove or disable any that were not intentionally created by administrators.
• Rotate any credentials that were stored inside PRTG or that could have been accessed by a newly created privileged account.
• Harden the installation by restricting administrative access to trusted management networks, enforcing strong authentication, and ensuring the web interface is not exposed to the internet without additional controls.

If you can't patch immediately

Until the vendor update can be applied, reduce the attack surface with compensating controls.

• Segment the PRTG host so that only authorized management stations can reach the web interface and probe ports; block all other inbound traffic at the network firewall.
• If a web application firewall or reverse proxy sits in front of PRTG, enable rules that block common local-file-inclusion patterns and unexpected user-creation requests; test carefully to avoid breaking legitimate monitoring functions.
• Temporarily disable any non-essential features that accept unauthenticated input if the vendor documentation permits it.
• Increase monitoring for new user accounts, privilege changes, and unusual file-access activity on the PRTG server; alert on any such events.
• If mitigations cannot be implemented and the risk is unacceptable, discontinue use of the product until a patched version is available, as stated in the CISA guidance.

If your data may have been exposed

Actively exploited vulnerabilities of this type can lead to unauthorized access and data exposure. Review PRTG logs and any downstream systems for signs of compromise, rotate credentials that may have been stored or retrieved through the platform, and consider running a free exposure scan of organizational email addresses against known breach data sets to determine whether related accounts appear in public breach collections.