CVE-2023-45858: Paessler PRTG Path Traversal Vulnerability

CVE-2023-45858 Overview

CVE-2023-45858 is a directory traversal vulnerability in Paessler PRTG Network Monitor versions prior to 23.4.88.1429. The flaw allows a remote attacker to read arbitrary local files on the host running the PRTG server. The issue is classified as Relative Path Traversal [CWE-23] and can be triggered over the network without authentication or user interaction. Paessler resolved the issue in PRTG release 23.4.88.1429.

Critical Impact
Unauthenticated remote attackers can read sensitive local files from the PRTG server, potentially exposing configuration files, credentials, and monitoring data used to pivot into the wider infrastructure.

Affected Products

Paessler PRTG Network Monitor versions before 23.4.88.1429
Paessler PRTG Hosted Monitor instances running affected builds
Any deployment using vulnerable PRTG server binaries exposed to network access

Discovery Timeline

2026-09-14 - CVE-2023-45858 published to NVD
2026-09-14 - Last updated in NVD database

Technical Details for CVE-2023-45858

Vulnerability Analysis

The vulnerability is a directory traversal flaw in the Paessler PRTG web interface. An attacker crafts an HTTP request that references files outside the intended web resource directory using traversal sequences. The PRTG server resolves the path without properly normalizing or validating it against an allow-listed base directory. As a result, the server returns the contents of arbitrary files readable by the PRTG service account.

Because PRTG typically runs with elevated privileges on Windows hosts, an attacker can access configuration files, monitoring credentials, and system files. The exploit requires no authentication and can be executed remotely over HTTP or HTTPS. The scope-changed CVSS metric indicates that a successful attack impacts resources beyond the vulnerable component itself.

The EPSS score of 0.659% reflects moderate predicted exploitation activity relative to other CVEs published in the same timeframe.

Root Cause

The root cause is improper sanitization of user-supplied path input in HTTP request handling, tracked under CWE-23: Relative Path Traversal. The application accepts relative path components such as ../ sequences and resolves them against a base directory without enforcing that the final canonical path remains within an approved root. See the Paessler PRTG Vulnerability Advisory for vendor-provided remediation details.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to the PRTG web server containing directory traversal sequences in a file-reference parameter. The server processes the request, resolves the traversed path, and returns the requested file contents in the HTTP response. Attackers typically target Windows system files, PRTG configuration files containing device credentials, and log files that may reveal internal network topology.

See the Paessler PRTG Release History for a full list of security fixes shipped in 23.4.88.1429 and later.

Detection Methods for CVE-2023-45858

Indicators of Compromise

HTTP requests to the PRTG web interface containing ../, ..%2f, or URL-encoded traversal sequences in query strings or path parameters.
Unexpected access to sensitive local file paths such as C:\Windows\win.ini, C:\ProgramData\Paessler\PRTG Network Monitor\, or credential store files reflected in PRTG web server logs.
Anomalous outbound data volume from the PRTG server following inbound requests from untrusted IP addresses.

Detection Strategies

Inspect PRTG web server access logs for request patterns matching directory traversal signatures against the vulnerable endpoints.
Deploy web application firewall (WAF) rules to flag HTTP requests containing encoded or unencoded path traversal sequences targeting PRTG hosts.
Correlate authentication and file-access telemetry from the PRTG server host to identify reads of sensitive files that do not originate from the PRTG service's normal operational behavior.

Monitoring Recommendations

Alert on requests to PRTG server URLs from source IPs outside expected administrative network ranges.
Monitor for the PRTG service process reading files outside its installation directory and normal working paths.
Track version banners and installed build numbers across PRTG deployments to identify hosts still running versions below 23.4.88.1429.

How to Mitigate CVE-2023-45858

Immediate Actions Required

Upgrade all Paessler PRTG installations to version 23.4.88.1429 or later without delay.
Restrict network access to the PRTG web interface using firewall rules that limit connectivity to trusted administrative subnets and VPN endpoints.
Rotate credentials stored within PRTG, including SNMP community strings, WMI credentials, and device passwords, if you suspect the server was exposed to untrusted networks before patching.

Patch Information

Paessler released a fixed build in PRTG 23.4.88.1429. Administrators should apply the update through the built-in auto-update mechanism or download the installer from the Paessler PRTG Release History. Refer to the Paessler PRTG Vulnerability Advisory for details on the specific fix.

Workarounds

Place the PRTG web interface behind a reverse proxy or WAF that strips or blocks path traversal sequences in incoming requests until patching completes.
Enforce IP allow-listing so only known administrative hosts can reach the PRTG web console.
Run the PRTG service under a least-privilege account to reduce the sensitivity of files readable through the traversal flaw.

bash

# Example: Restrict inbound access to PRTG web interface on Windows using netsh
netsh advfirewall firewall add rule name="PRTG Web Admin Only" \
    dir=in action=allow protocol=TCP localport=443 \
    remoteip=10.0.0.0/24 profile=any

netsh advfirewall firewall add rule name="Block PRTG Web External" \
    dir=in action=block protocol=TCP localport=443 profile=any