CVE-2025-67833
📋 TL;DR
CVE-2025-67833 is a cross-site scripting (XSS) vulnerability in Paessler PRTG Network Monitor that allows unauthenticated attackers to inject malicious scripts via the tag parameter. This affects all organizations running PRTG Network Monitor versions before 25.4.114. Successful exploitation could lead to session hijacking, credential theft, or redirection to malicious sites.
💻 Affected Systems
- Paessler PRTG Network Monitor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attacker steals administrator credentials, gains full control of PRTG system, pivots to internal network, and deploys ransomware across monitored infrastructure.
Likely Case
Attacker hijacks user sessions, steals credentials, redirects users to phishing sites, or defaces the PRTG interface.
If Mitigated
Script execution is blocked by browser security features or web application firewall, limiting impact to minor interface disruption.
🎯 Exploit Status
XSS vulnerabilities are commonly weaponized. The unauthenticated nature makes this particularly attractive to attackers.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 25.4.114 or later
Vendor Advisory: https://helpdesk.paessler.com/en/support/solutions/articles/76000087289-vulnerabilities-in-prtg-prior-v25-4-114-1032
Restart Required: Yes
Instructions:
1. Download PRTG 25.4.114 or later from Paessler website. 2. Backup current configuration. 3. Run installer with administrator privileges. 4. Restart PRTG services.
🔧 Temporary Workarounds
Web Application Firewall (WAF)
allDeploy WAF rules to block XSS payloads in tag parameter
Network Segmentation
allRestrict PRTG web interface access to trusted networks only
🧯 If You Can't Patch
- Implement strict Content Security Policy (CSP) headers to prevent script execution
- Deploy reverse proxy with XSS filtering for all PRTG web traffic
🔍 How to Verify
Check if Vulnerable:
Check PRTG version in web interface: Settings → System Administration → Version InformationCheck Version:
On PRTG server: Get-ItemProperty -Path "HKLM:\SOFTWARE\Paessler\PRTG Network Monitor" -Name "Version" (Windows) or cat /usr/local/prtg/version.txt (Linux)Verify Fix Applied:
Confirm version is 25.4.114 or higher in Version Information page📡 Detection & Monitoring
Log Indicators:
- Unusual tag parameter values in web logs
- JavaScript payloads in URL parameters
- Multiple failed XSS attempts
Network Indicators:
- HTTP requests with suspicious script tags in parameters
- Unusual traffic patterns to PRTG web interface
SIEM Query:
source="prtg_web.log" AND (tag="*<script*" OR tag="*javascript:*" OR tag="*onerror=*")