CVE-2018-19410

What is PRTG Network Monitor?

PRTG Network Monitor, made by German vendor Paessler, is a widely deployed all-in-one infrastructure monitoring platform. It watches network devices, servers, bandwidth usage, applications, and cloud services from a single web console, and is popular with IT teams at organizations of all sizes because it consolidates SNMP, WMI, flow, and sensor-based monitoring into one dashboard. Because PRTG typically has broad network visibility and often runs with elevated credentials to poll devices, compromising it gives an attacker both a foothold and a map of the internal network.

Overview

CVE-2018-19410 is a local file inclusion (LFI) flaw in PRTG's web interface that a remote, unauthenticated attacker can exploit to include and execute a local file on the server. The practical impact documented for this CVE is severe: an attacker can use the LFI to reach functionality that creates new PRTG users with read-write (including full administrator) privileges — effectively turning an unauthenticated LFI into an unauthenticated path to full application takeover.

Technical Details

The root cause is insufficient validation of a parameter used to construct a file path passed into an include/require-style operation in PRTG's PHP/ASP-based web components, letting an attacker point the parameter at unintended local resources. Because PRTG's web interface exposes some functionality prior to authentication, an attacker can chain the file-inclusion primitive with PRTG's user-management logic to provision a new administrator account without ever supplying valid credentials. From there, the attacker has the same access as a legitimate PRTG administrator: viewing all monitored device credentials, modifying sensors, and potentially pivoting further into the monitored network.

Discovery

Paessler addressed the issue in PRTG 18.2.41.1652, released shortly after the CVE was published in late 2018. No specific third-party researcher credit for the original discovery is confidently documented.

Exploitation Context

CVE-2018-19410 sat in NVD for over six years before CISA added it to the KEV catalog in February 2025, indicating that exploitation activity was observed in the wild long after the original 2018 patch — consistent with the reality that many PRTG instances are internet-facing management consoles that are rarely upgraded once deployed. Unpatched instances remain an attractive target precisely because successful exploitation yields full administrative control with no authentication required.

Remediation

1. Upgrade PRTG Network Monitor to version 18.2.41.1652 or later (and ideally to the current supported release, since many subsequent security fixes have shipped since 2018).
2. Audit the PRTG user list for any unrecognized or unauthorized administrator accounts, which would indicate this vulnerability has already been exploited.
3. Restrict access to the PRTG web console to trusted internal networks or a VPN — it should never be directly reachable from the public internet.
4. Rotate credentials for any devices/services monitored by PRTG if unauthorized administrative access is suspected, since PRTG typically stores or has access to device credentials.
5. Review PRTG and web server logs for anomalous requests containing path traversal sequences or unexpected parameter values around the time period in question.