AI analysis
PRTG Network Monitor before version 26.2.120.1449 ships a demo VBScript sensor that multiplies two integer parameters using cscript.exe. This flaw triggers a type-mismatch error when a non-numeric value is passed, causing the error message to include the offending parameter value in plaintext. A documented placeholder variable, %windowspassword, can be used to pass the configured Windows/domain password, which allows an unauthenticated user to expose the password in plaintext. This vulnerability can be exploited by users who are not restricted to read-only access and can create sensors, enabling an attacker to gain unauthorized access and disclose sensitive information. The affected product is PRTG Network Monitor, and the exposed functionality is the demo sensor. Current exploitation status is unknown as no public exploit is known.
What to do: Upgrade PRTG Network Monitor to version 26.2.120.1449 or later. Implement strict input validation for sensor parameters and disable the demo VBScript sensor or restrict its execution. Regularly audit PRTG installations for exposed components and enforce read-only access for non-admin users.
Affected
| PRTG Network Monitor | before 26.2.120.1449 |
Estimated exposure
—No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description
PRTG Network Monitor before version 26.2.120.1449 ships a demo EXE/Script sensor that multiplies two integer parameters using cscript.exe. If a non-numeric value is passed instead, cscript.exe raises a 'Type mismatch' runtime error that includes the offending parameter value in plaintext. PRTG provides a documented placeholder variable, %windowspassword, which resolves to the configured Windows/domain password used by PRTG and can be passed as a sensor parameter. Any PRTG user who is not restricted to read-only access and is permitted to create sensors (the default for non-read-only users) can pass %windowspassword as an argument to the demo VBScript sensor, triggering the type-mismatch error and causing PRTG to display the plaintext password in the sensor's error output.