PT-2020-12682 · Paessler · Prtg Network Monitor

Ch-Rigu · Published 2020-04-04 · Updated 2020-04-07 · CVE-2020-11547

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions PRTG Network Monitor versions prior to 20.1.57.1745

Description The issue allows remote unauthenticated attackers to obtain sensitive information about the server, including CPU usage, memory, Windows version, and internal statistics, by sending an HTTP request. This can be achieved by accessing specific pages, such as login.htm or index.htm, with a type=probes parameter.

Recommendations For versions prior to 20.1.57.1745, update to version 20.1.57.1745 or later to resolve the issue. As a temporary workaround, consider restricting access to the login.htm and index.htm pages to minimize the risk of exploitation. Avoid using the type=probes parameter in HTTP requests to these pages until the issue is resolved.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2020-11547

Affected Products

Prtg Network Monitor

References · 5

• 🔥 https://github.com/ch-rigu/CVE-2020-11547--PRTG-Network-Monitor-Information-Disclosure · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-11547 · Security Note
• https://osv.dev/vulnerability/CVE-2020-11547 · Vendor Advisory
• https://github.com/ch-rigu/PRTG-Network-Monitor-Information-Disclosure · Note
• https://t.me/cvenotify/2415 · Telegram Post