CVE-2023-32781 in the critical feed json
A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user wi…
published 2023-08-09 3 y ago modified 2026-06-17 4 mo ago also EUVD-2023-37004
- cvss
- 7.2
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 14.3%
- EPSS 14.3% chance of exploitation in 30 days, percentile 96%
- public exploits
- 1
- Metasploit
Summary
A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Patch / fix
- paessler prtg_network_monitor 23.3.86.1520
Timeline
- Published
- First public exploit (Metasploit exploit/windows/http/prtg_authenticated_rce_cve_2023_32781)
Exploit prediction
14.26% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- Metasploit exploit/windows/http/prtg_authenticated_rce_cve_2023_32781 PRTG CVE-2023-32781 Authenticated RCE metasploit exploit, excellent rank, 2023-08-09
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
Classification
- Weakness
-
- CWE-77 Improper Neutralization of Special Elements used in a Command
References
Sources
- CVE List CVE-2023-32781
- NVD CVE-2023-32781
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.