CVE-2023-32782
📋 TL;DR
This CVE describes a command injection vulnerability in PRTG Network Monitor's DICOM C-ECHO sensor. Authenticated users with write permissions can exploit the debug option to create files that may be executed via the EXE/Script sensor, potentially leading to remote code execution. The vulnerability affects PRTG versions 23.2.84.1566 and earlier.
💻 Affected Systems
- Paessler PRTG Network Monitor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
An authenticated attacker with write permissions could achieve remote code execution with SYSTEM/root privileges, leading to complete compromise of the PRTG server and potentially lateral movement within the network.
Likely Case
An authenticated malicious insider or compromised account with write permissions could execute arbitrary commands on the PRTG server, potentially gaining persistent access or exfiltrating sensitive monitoring data.
If Mitigated
With proper access controls limiting write permissions to trusted administrators only, the attack surface is significantly reduced, though the vulnerability still exists in the software.
🎯 Exploit Status
Exploitation requires authenticated access with write permissions and knowledge of the PRTG environment. The vulnerability chain involves file creation followed by execution via another sensor.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 23.3.86.1520
Vendor Advisory: https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520
Restart Required: Yes
Instructions:
1. Backup PRTG configuration. 2. Download PRTG 23.3.86.1520 or later from Paessler website. 3. Run installer with administrative privileges. 4. Follow upgrade wizard. 5. Restart PRTG services.
🔧 Temporary Workarounds
Disable DICOM C-ECHO sensor debug option
allRemove or restrict debug functionality in DICOM C-ECHO sensors to prevent file creation
Restrict write permissions
allLimit write permissions on PRTG to essential administrators only
🧯 If You Can't Patch
- Implement strict access controls to limit write permissions to trusted administrators only
- Monitor for suspicious file creation in PRTG directories and unusual EXE/Script sensor activity
🔍 How to Verify
Check if Vulnerable:
Check PRTG version in web interface under Setup > System Administration > Version InformationCheck Version:
On PRTG server: Check web interface or examine PRTG installation directory for version filesVerify Fix Applied:
Verify version is 23.3.86.1520 or later and test DICOM C-ECHO sensor debug functionality📡 Detection & Monitoring
Log Indicators:
- Unusual file creation in PRTG directories
- Suspicious debug parameter usage in DICOM sensor logs
- Unexpected EXE/Script sensor executions
Network Indicators:
- Unusual outbound connections from PRTG server
- Anomalous authentication patterns to PRTG web interface
SIEM Query:
source="PRTG" AND (event_type="file_creation" OR event_type="sensor_execution") AND (process="DICOM" OR sensor="EXE/Script")🔗 References
- https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520
- https://www.paessler.com/prtg/history/stable
- https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520
- https://www.paessler.com/prtg/history/stable
