CVE-2023-22631 Overview
CVE-2023-22631 affects Paessler PRTG Network Monitor before version 23.1.82. The vulnerability allows a remote authenticated attacker with high privileges to write to files on the host through the HTTP XML/REST Sensor. The weakness is categorized under [CWE-88] Improper Neutralization of Argument Delimiters in a Command, commonly referred to as argument injection. According to Paessler's CVE Impact Analysis, the issue is addressed in PRTG 23.1.82 and later. Exploitation requires network access and elevated privileges within PRTG, limiting the impact to integrity of files writable by the PRTG service account.
Critical Impact
Authenticated remote attackers can write arbitrary files on PRTG hosts running versions before 23.1.82, enabling tampering with monitoring data or configuration artifacts.
Affected Products
- Paessler PRTG Network Monitor versions prior to 23.1.82
- HTTP XML/REST Sensor component within PRTG
- On-premises PRTG deployments monitored via the affected sensor type
Discovery Timeline
- 2026-09-14 - CVE-2023-22631 published to the National Vulnerability Database (NVD)
- 2026-09-14 - Last updated in NVD database
Technical Details for CVE-2023-22631
Vulnerability Analysis
The flaw resides in the HTTP XML/REST Sensor of PRTG Network Monitor. This sensor issues HTTP requests to a configured endpoint and parses the returned XML or REST payload for monitored values. The sensor invokes an underlying process with user-controlled arguments without adequately neutralizing argument delimiters. As a result, a privileged PRTG user can inject additional command-line options that redirect output or otherwise cause the invoked utility to write attacker-chosen files. Because the sensor runs within the PRTG probe service context, any file writable by that service account is a viable target. Paessler documented the fix and impact scope in its CVE Impact Analysis.
Root Cause
The root cause is improper argument neutralization [CWE-88]. Sensor parameters supplied through the PRTG interface are forwarded to a downstream binary without stripping or escaping option-style tokens. Attackers can therefore append flags recognized by the utility, including flags that specify output file destinations.
Attack Vector
Exploitation requires network access to the PRTG web console and an account with sufficient rights to configure or edit an HTTP XML/REST Sensor. The attacker crafts sensor parameters that carry extra command-line arguments. When the sensor executes, the injected arguments cause the invoked process to write a file selected by the attacker. No user interaction is required.
No verified public exploit code is available for CVE-2023-22631. For technical detail, refer to the Paessler PRTG Overview and the vendor advisory.
Detection Methods for CVE-2023-22631
Indicators of Compromise
- Unexpected file creation or modification in directories writable by the PRTG probe service account
- HTTP XML/REST Sensor configurations containing unusual characters, whitespace, or option-style tokens such as -- or -o inside URL or parameter fields
- New or altered sensors created by administrative accounts outside change-management windows
Detection Strategies
- Inventory PRTG installations and flag any core or probe running a version earlier than 23.1.82
- Review PRTG audit logs for sensor create and edit events targeting the HTTP XML/REST Sensor type
- Alert on process executions spawned by the PRTG probe that write to sensitive paths or accept unexpected output flags
Monitoring Recommendations
- Forward PRTG application and Windows event logs to a centralized analytics platform for correlation
- Baseline the file system paths written by the PRTG service account and alert on deviations
- Monitor for privilege changes on PRTG accounts, especially the assignment of sensor-editing rights
How to Mitigate CVE-2023-22631
Immediate Actions Required
- Upgrade PRTG Network Monitor to version 23.1.82 or later on all core and probe systems
- Restrict sensor creation and editing rights to a minimum set of administrative accounts
- Audit existing HTTP XML/REST Sensors for suspicious parameter values and remove or rebuild any that appear tampered with
Patch Information
Paessler resolved CVE-2023-22631 in PRTG Network Monitor 23.1.82. Refer to the Paessler CVE Impact Analysis for vendor-confirmed remediation details and upgrade guidance.
Workarounds
- Disable the HTTP XML/REST Sensor type on probes where it is not required until patching is complete
- Enforce network segmentation so the PRTG web console is not exposed beyond trusted administrative networks
- Run the PRTG probe service under a least-privileged account with limited write access to critical directories
For configuration-hardening guidance, consult Paessler's official documentation linked from the Paessler PRTG Overview.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
