Test ID:	1.3.6.1.4.1.25623.1.0.143666
Category:	Web application abuses
Title:	PRTG Network Monitor < 20.1.57.1745 RCE Vulnerability
Summary:	PRTG Network Monitor is prone to an unauthenticated remote code; execution (RCE) vulnerability.
Description:	Summary: PRTG Network Monitor is prone to an unauthenticated remote code execution (RCE) vulnerability. Vulnerability Insight: With a carefully crafted POST request, a possible attacker can perform an RCE by executing a UNC path on the PRTG core server system with the security context of the PRTG core server service, without the need of an authenticated session. By utilizing the what parameter of the screenshot function that is used in the Contact Support form in PRTG, for example, an attacker is able to inject a crafted, URI-compatible UNC path that is executed as part of the caller chain down to the Chromium engine to create the screenshot. Affected Software/OS: PRTG Network Monitor versions 19.2.50 through 20.1.56. Solution: Update to version 20.1.57.1745 or later. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2020-10374 https://kb.paessler.com/en/topic/87668-how-can-i-mitigate-cve-2020-10374-until-i-can-update https://tehtris.com/en/rce-on-prtg-network-monitor-tehtris-pentest/
Copyright	Copyright (C) 2020 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.