TI-2023-16034 Aliases CVE-2023-32781 GHSA-6hrq-pjj8-qgcg

A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier…

MEDIUM 47CWE-77Published 2023-08-09 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.

Summary

A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Why it matters now

EPSS 0.14261 96th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
—	—	all versions	—	No fix listed	CNA

— Vendor— Affected all versions Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:paessler:prtg_network_monitor::::::::	before 23.3.86.1520	Vulnerable	Paessler

cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:* Versions before 23.3.86.1520 Vulnerable ·Paessler

Remediation

No fixed version listed by the sources yet.

Timeline

2026-10-02 Threatist record created from CVE-2023-32781
2026-10-03 Alias added: GHSA-6hrq-pjj8-qgcg

References

Advisory 1

https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520

Other 2

TI-2018-13743 PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to… KEVCVSS 3.1CRITICAL 9.8
TI-2018-06724 An issue was discovered in PRTG Network Monitor before 18.2.39. KEVCVSS 3.1HIGH 7.2
TI-2023-16035 A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom… CVSS 3.1HIGH 7.2
TI-2022-16181 PRTG Network Monitor through 22.2.77.2204 does not prevent custom input for a device’s… CVSS 3.1MEDIUM 5.3
TI-2020-09265 PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to… CVSS 3.1MEDIUM 5.3
TI-2020-08308 A webserver component in Paessler PRTG Network Monitor 19.2.50 to PRTG 20.1.56 allows… CVSS 3.1CRITICAL 9.8

See all 38 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences