Paessler PRTG Network Monitor Authentication Bypass and Admin Creation Vulnerability (CVE-2018-19410) Analysis & Mitigation Guide
Executive & SecOps Summary
SECOPS ASSESSMENTPaessler PRTG Network Monitor versions prior to 18.2.40.1683
Unauthenticated remote attackers can exploit a Local File Inclusion (LFI) vulnerability to create unauthorized accounts with administrative privileges, leading to full system compromise
Immediately upgrade PRTG Network Monitor to version 18.2.40.1683 or later and restrict external access to the web console
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
To remediate this vulnerability, upgrade PRTG Network Monitor to the latest secure version. Use the following PowerShell commands to verify the installed version and manage the services during the update process.
# Check the currently installed PRTG version via Registry
Get-ItemProperty -Path 'HKLM:\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\*' | Where-Object { $_.DisplayName -like '*PRTG*' } | Select-Object DisplayName, DisplayVersion
# Stop PRTG services before applying the official update
Stop-Service -Name 'PRTGCoreService'
Stop-Service -Name 'PRTGProbeService'2. Temporary Workaround & Hardening Configuration
If an immediate upgrade is not feasible, restrict access to the PRTG web interface using Windows Advanced Firewall to allow only trusted administrative IP addresses.
# Block all external access to PRTG port (default 443) and allow only trusted subnet (e.g., 192.168.1.0/24)
New-NetFirewallRule -DisplayName 'Block PRTG External Access' -Direction Inbound -Action Block -Protocol TCP -LocalPort 443 -RemoteAddress Any
New-NetFirewallRule -DisplayName 'Allow PRTG Admin Access' -Direction Inbound -Action Allow -Protocol TCP -LocalPort 443 -RemoteAddress '192.168.1.0/24'3. Log Audit & IoC Verification Commands
Inspect the PRTG web server logs for unauthorized attempts to access /public/login.htm combined with parameters pointing to addusers or containing suspicious 'id' and 'users' arguments.
# Search for unauthorized calls to addusers in PRTG Web Server logs
grep -i 'addusers' /cygdrive/c/ProgramData/Paessler/PRTG\ Network\ Monitor/Logs/Web\ Server/*.log
grep -i 'login.htm' /cygdrive/c/ProgramData/Paessler/PRTG\ Network\ Monitor/Logs/Web\ Server/*.log | grep -E 'id=|users='Stop Exposing VPN Ports to the Internet — Switch to Zero-Trust Access
Eliminate public-facing VPN concentrators and firewall management ports with identity-first Zero-Trust Network Access.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability exists in the template rendering engine of the login page (/public/login.htm) in Paessler PRTG Network Monitor. An unauthenticated remote attacker can manipulate HTTP request parameters to override attributes of the server-side 'include' directive. This flaw allows the attacker to perform a Local File Inclusion (LFI) attack, forcing the application to include and execute the internal /api/addusers script without authentication.
2. Exploitation Mechanics & Attack Scenario
An attacker crafts a malicious HTTP request targeting /public/login.htm. By supplying specific parameters such as 'id' and 'users', the attacker triggers the LFI vulnerability to load the /api/addusers endpoint. Because this process bypasses the standard authentication checks, the application processes the request as a legitimate administrative action, creating a new user account with full read-write and administrator privileges.
3. Infrastructure & Business Impact
PRTG Network Monitor is widely used to oversee critical IT infrastructure, servers, and network devices. Successful exploitation of this vulnerability allows an attacker to gain full administrative control over the PRTG instance. This can lead to the exposure of sensitive network topologies, theft of stored credentials for monitored devices, and potential Remote Code Execution (RCE) via custom sensor scripts, posing a severe threat to the entire corporate network.
Official Vendor Advisories & References
PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).
Frequently Asked SecOps Questions (CVE-2018-19410)
FAQQ1. How critical is CVE-2018-19410 and is it actively exploited in the wild?
CVE-2018-19410 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 97.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2018-19410?
Primary impacted vendors include paessler across prtg network monitor. Scope summary: All Paessler PRTG Network Monitor versions prior to 18.2.40.1683
Q3. What temporary mitigations or workarounds exist for CVE-2018-19410 before patching?
[Mitigation] Immediately upgrade PRTG Network Monitor to version 18.2.40.1683 or later and restrict external access to the web console Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2018-19410
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (paessler)
View Category →Arista VeloCloud Orchestrator (VCO) Remote Code Execution and Privilege Escalation (CVE-2026-93952)
[Affected Scope] Arista VeloCloud Orchestrator (VCO) On-premise deployments.
Cisco Identity Services Engine (ISE) Critical Authentication Bypass Vulnerability (CVE-2026-76460)
[Affected Scope] Cisco Identity Services Engine (ISE) web-based management interface and API endpoints.
SonicWall SMA1000 Work Place Pre-Authentication Server-Side Request Forgery (SSRF) Vulnerability (CVE-2026-83548)
[Affected Scope] SonicWall SMA1000 Series Appliance Work Place interface
Arista VeloCloud Orchestrator (VCO) On-Premises Remote Code Execution and Privilege Bypass (CVE-2026-16812)
[Affected Scope] On-premises deployments of VeloCloud Orchestrator (VCO)
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.