CVE-2023-28148: Paessler PRTG XSS Vulnerability

CVE-2023-28148 Overview

CVE-2023-28148 is a stored cross-site scripting (XSS) vulnerability in Paessler PRTG Network Monitor. The flaw resides in the bodyclass handling of the PRTG web interface. Attackers can inject malicious script content that executes in the browser context of users accessing affected pages. Paessler resolved the issue in PRTG version 23.3.86.1520.

The vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation). Successful exploitation can lead to session compromise, unauthorized configuration changes, and pivoting into monitored network segments through the PRTG console.

Critical Impact
Attackers can execute arbitrary JavaScript in the context of authenticated PRTG users, enabling credential theft and unauthorized access to network monitoring data.

Affected Products

Paessler PRTG Network Monitor versions prior to 23.3.86.1520
PRTG Enterprise Monitor deployments running vulnerable builds
Self-hosted PRTG installations using the affected web interface

Discovery Timeline

2026-09-14 - CVE-2023-28148 published to the National Vulnerability Database
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-28148

Vulnerability Analysis

The vulnerability originates in how PRTG generates the bodyclass attribute within its rendered HTML output. The application fails to properly neutralize user-controlled input before including it in the body element's class attribute. This allows attackers to break out of the attribute context and inject arbitrary HTML or JavaScript.

Because the injected content executes in the trusted origin of the PRTG web console, attackers gain access to session cookies, CSRF tokens, and any data visible to the victim user. PRTG typically runs with elevated privileges to monitor network infrastructure, making the console a high-value target.

The attack requires no authentication or user interaction based on the CVSS vector, and the scope is changed, meaning exploitation impacts resources beyond the vulnerable component.

Root Cause

The root cause is improper output encoding when constructing the HTML body tag's class attribute. Input that flows into bodyclass is not escaped for the HTML attribute context, allowing attribute-breaking payloads and inline event handlers to execute.

Attack Vector

An attacker crafts a URL or request that causes attacker-controlled data to appear in the bodyclass value on a rendered PRTG page. When a user with an active PRTG session loads the page, the injected script executes. The attacker can then exfiltrate the session token, submit administrative actions on behalf of the victim, or plant persistent monitoring changes.

The vulnerability manifests through unsafe attribute concatenation in the PRTG web interface rendering path. Refer to the Paessler PRTG Version History 23 for vendor details on the fix.

Detection Methods for CVE-2023-28148

Indicators of Compromise

HTTP requests to PRTG endpoints containing encoded angle brackets, onerror=, onload=, or javascript: payloads within parameters influencing page rendering
Anomalous outbound connections from browsers of PRTG administrators to unknown domains shortly after visiting the PRTG console
Unexpected changes to PRTG sensor configurations, notification templates, or user accounts
Web server logs showing unusual Referer headers or unexpected query strings on PRTG URLs

Detection Strategies

Inspect PRTG web server access logs for query parameters containing HTML metacharacters or common XSS payload signatures
Deploy a web application firewall rule set that flags attribute-breaking sequences targeting the PRTG console URL space
Correlate PRTG administrative actions with the source IP and session context of the initiating user to spot session hijacking

Monitoring Recommendations

Enable verbose logging on the PRTG web server and forward logs to a central analytics platform for retention and search
Alert on new or modified PRTG user accounts, especially accounts granted administrative roles
Monitor browser-side Content Security Policy (CSP) violation reports if CSP is configured on the PRTG console

How to Mitigate CVE-2023-28148

Immediate Actions Required

Upgrade Paessler PRTG to version 23.3.86.1520 or later without delay
Rotate PRTG administrator credentials and invalidate active sessions after patching
Restrict access to the PRTG web console to trusted management networks using firewall rules or VPN
Review PRTG audit logs for suspicious configuration changes made prior to remediation

Patch Information

Paessler addressed the issue in PRTG 23.3.86.1520. Refer to the Paessler PRTG Stable Version History for release notes and the Paessler PRTG Version History 23 for the specific fix entry. Apply the update through the standard PRTG auto-updater or download the installer from the vendor portal.

Workarounds

Limit network reachability of the PRTG web interface to a small set of administrator workstations until patching completes
Require administrators to use a dedicated, hardened browser profile for PRTG access to reduce cross-application session exposure
Enforce short session timeouts for PRTG user accounts to shrink the exploitation window

bash

# Configuration example: restrict PRTG web console access with Windows Firewall
New-NetFirewallRule -DisplayName "PRTG-Web-Restrict" \
  -Direction Inbound -Protocol TCP -LocalPort 443 \
  -RemoteAddress 10.10.20.0/24 -Action Allow

New-NetFirewallRule -DisplayName "PRTG-Web-BlockOther" \
  -Direction Inbound -Protocol TCP -LocalPort 443 \
  -Action Block