Paessler PRTG Network Monitor Local File Inclusion (CVE-2018-19410)

Historical catalog analysis: CISA added this entry on February 04, 2025. The entry reflects catalog information retrieved on August 31, 2026, not a snapshot archived on the inclusion date. Check current vendor guidance before acting.

What the vulnerability is

CVE-2018-19410 is a local file inclusion (LFI) vulnerability affecting Paessler PRTG Network Monitor. This flaw enables a remote, unauthenticated attacker to create new user accounts within the system. These accounts can be granted read-write privileges, including full administrative access.

Exposure and applicability

This vulnerability applies to organizations deploying Paessler PRTG Network Monitor. The primary exposure path is remote and does not require prior authentication, making any instance of the software exposed to the network a potential target for unauthorized account creation.

Remediation priorities

Based on the reported risk of administrative takeover, our analysis suggests the following prioritization for vulnerability management teams:

1. Immediate Asset Identification: Identify all active instances of Paessler PRTG Network Monitor across the environment. Priority should be given to those with network visibility or external exposure.
2. Vendor Mitigation Application: Apply the mitigations provided by Paessler. According to source data, these are available in specific version updates (e.g., referenced in the PRTG 18 history).
3. Decommissioning: If vendor-provided mitigations cannot be applied or are unavailable for a specific legacy deployment, the product should be discontinued to eliminate the exposure.

How to validate remediation

To ensure that the risk has been reduced, defenders should move beyond simple version checks. We recommend the following validation steps:

• Account Audit: Perform a comprehensive review of all existing administrative and read-write user accounts. The presence of unknown or unauthorized accounts may indicate that the vulnerability was exploited prior to patching.
• Configuration Verification: Confirm that the specific software versions deployed match those identified by the vendor as containing the fix.
• Access Control Review: Verify that the management interface is restricted to authorized networks, reducing the remote attack surface while patches are being validated.

Limits and open questions

While applying vendor updates reduces the likelihood of this specific LFI flaw being exploited, it does not guarantee total system security. Residual risk remains if unauthorized accounts were created before the mitigation was applied; patching the software does not automatically remove existing malicious users. Additionally, the source does not specify whether this vulnerability has been utilized in known ransomware campaigns.

Source and editorial note

CVE-2018-19410: Paessler PRTG Network Monitor Local File Inclusion Vulnerability · Source date: February 04, 2025 · Retrieved August 31, 2026.

Material facts are tied to the cited primary source. Recommendations are independent defensive analysis unless attributed to the source. Confirm consequential decisions against current authoritative guidance.

Archive date: February 07, 2025. The displayed post date is assigned three days after the source date to organize this retrospective archive; it does not mean this site published the analysis then. First published by this site: October 26, 2026 at 00:40 UTC.

Request a Vulnerability Assessment