CVE-2023-22632: PRTG Network Monitor RCE Vulnerability

CVE-2023-22632 Overview

CVE-2023-22632 affects Paessler PRTG Network Monitor versions prior to 23.1.82. The vulnerability allows a remote attacker with high privileges to write to files through the FTP Server Count Sensor. The issue is classified under [CWE-88] Improper Neutralization of Argument Delimiters in a Command (Argument Injection). Successful exploitation impacts file integrity on the affected system without directly compromising confidentiality or availability. Paessler addressed the flaw in PRTG version 23.1.82.

Critical Impact
An authenticated attacker with elevated PRTG privileges can write to files on the monitoring server through the FTP Server Count Sensor, potentially altering monitored data or configuration artifacts.

Affected Products

Paessler PRTG Network Monitor versions before 23.1.82
PRTG installations exposing the FTP Server Count Sensor
Deployments where privileged sensor configuration is delegated to non-administrative users

Discovery Timeline

2026-09-14 - CVE-2023-22632 published to the National Vulnerability Database (NVD)
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-22632

Vulnerability Analysis

The vulnerability resides in the FTP Server Count Sensor component of PRTG Network Monitor. An attacker with high privileges on the PRTG instance can supply crafted sensor parameters that the application does not properly neutralize. The improper handling permits writing to files accessible to the PRTG service account. The remote attack path requires network access to the PRTG web or API interface. Because the flaw requires authenticated high-privilege access, exploitation is constrained to insiders or attackers who have already obtained privileged credentials.

Root Cause

The root cause is argument injection [CWE-88] in the FTP Server Count Sensor. PRTG passes user-controlled sensor configuration values into a downstream operation without adequate sanitization of argument delimiters. This gap permits attacker-controlled input to influence file-write behavior beyond the sensor's intended scope. Paessler's advisory confirms the fix ships in PRTG 23.1.82.

Attack Vector

Exploitation is remote and network-based but requires authenticated access with high privileges to configure or modify sensors. No user interaction is needed once the attacker holds the required credentials. The impact is limited to integrity — the ability to write to files reachable by the PRTG process. Confidentiality and availability are not directly affected. Refer to the Paessler CVE Impact Analysis for vendor-confirmed impact details.

No verified public proof-of-concept code is available for this CVE. Defenders should treat the FTP Server Count Sensor configuration surface as a sensitive input path and validate all sensor parameters against expected values.

Detection Methods for CVE-2023-22632

Indicators of Compromise

Unexpected modifications to files within the PRTG installation directory or data paths owned by the PRTG service account
FTP Server Count Sensor configurations containing unusual argument characters, path separators, or shell metacharacters
Sensor changes performed by administrative accounts outside of expected change windows

Detection Strategies

Audit PRTG configuration change logs for creation or modification of FTP Server Count Sensors by privileged users
Monitor file integrity on the PRTG server, focusing on directories writable by the PRTG service account
Correlate PRTG administrative logins with subsequent sensor configuration changes to identify suspicious sequences

Monitoring Recommendations

Enable and forward PRTG audit logs to a centralized logging platform for retention and analysis
Alert on any addition or edit of FTP Server Count Sensors in production environments
Track privileged PRTG account usage and flag logins from unexpected source addresses

How to Mitigate CVE-2023-22632

Immediate Actions Required

Upgrade PRTG Network Monitor to version 23.1.82 or later as documented in the Paessler CVE Impact Analysis
Review and reduce the number of PRTG accounts holding administrative or sensor-management privileges
Rotate credentials for any privileged PRTG accounts that may have been exposed

Patch Information

Paessler resolved CVE-2023-22632 in PRTG Network Monitor 23.1.82. Administrators should apply this release or a later version to remove the argument injection path in the FTP Server Count Sensor. See the Paessler PRTG product page for supported download channels and upgrade documentation.

Workarounds

Restrict the FTP Server Count Sensor to trusted administrators only and remove it where it is not required
Enforce least privilege on PRTG user roles so that only vetted operators can create or modify sensors
Segment the PRTG management interface on a restricted network reachable only from administrative workstations

bash

# Configuration example
# Verify the running PRTG core server version on Windows
"C:\Program Files (x86)\PRTG Network Monitor\PRTG Server.exe" /version

# Expected output should report version 23.1.82 or later