CVE-2018-19410: Paessler PRTG Network Monitor Local File Inclusion Allows Unauthenticated Admin Account Creation
What It Is — PRTG Network Monitor contains a Local File Inclusion (LFI) flaw that lets a remote, unauthenticated attacker write arbitrary files. By exploiting the flaw, an attacker can create new users with read‑write privileges, including full administrator rights.
Exploitability — The vulnerability is remotely exploitable without credentials. Public proof‑of‑concept code exists, and the CVSS v3.1 base score is 9.8 (Critical).
Affected Products — All supported versions of Paessler PRTG Network Monitor prior to the vendor’s June 2018 security update.
Why It Matters for Trust & Control Assurance
- Demonstrates the need for continuous verification that authentication and authorization controls are enforced, a core control objective across most frameworks.
- Highlights the importance of timely patch management as evidence of due‑diligence in a defensible audit trail.
- Shows that without robust logging of privileged‑account creation, organizations may lack the forensic data required for incident response and compliance reporting.
Recommended Actions
- Apply the Paessler‑released patch immediately and verify the version number.
- Conduct a rapid review of all PRTG user accounts; remove any unexpected privileged accounts.
- Strengthen your access‑control policies: enforce least‑privilege, multi‑factor authentication for admin portals, and regular review of role assignments.
- Enable detailed logging of user‑creation events and integrate them into a centralized SIEM for continuous monitoring.
- Document the remediation steps in your control‑evidence repository to support audit readiness.
Source: CISA KEV – CVE‑2018‑19410