CVE-2023-32782

Опубликовано: 09 авг. 2023

Источник: nvd

CVSS3: 7.2

EPSS Средний

Описание

A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Ссылки

https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520
Vendor Advisory
https://www.paessler.com/prtg/history/stable
Release Notes
https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520
Vendor Advisory
https://www.paessler.com/prtg/history/stable
Release Notes

Уязвимые конфигурации

Конфигурация 1

cpe:2.3:a:paessler:prtg_network_monitor:*:*:*:*:*:*:*:*

Версия до 23.3.86.1520 (исключая)

EPSS

Процентиль: 96%

0.21928

Средний

7.2 High

CVSS3

Дефекты

CWE-77

Связанные уязвимости

GHSA-x5rg-6gf6-5wg5

CVSS3: 9.8

github

больше 2 лет назад

An issue was discovered in Paessler PRTG Network Monitor 23.2.83.1760. Due to command-line parameter injection and an undocumented debug feature flag, an attacker can utilize the DICOM sensor to write arbitrary data to the disk. This can be utilized to write a custom EXE(.bat) sensor, that will then run. This primitive gives remote code execution.