CVE-2025-67833 Overview
CVE-2025-67833 is a reflected Cross-Site Scripting (XSS) vulnerability affecting Paessler PRTG Network Monitor versions prior to 25.4.114. The flaw resides in the handling of the tag parameter, which fails to properly sanitize attacker-controlled input before rendering it in the web interface. An unauthenticated attacker can craft a malicious URL that, when opened by a victim, executes arbitrary JavaScript in the victim's browser context. The vulnerability is tracked under CWE-79 (Improper Neutralization of Input During Web Page Generation).
Critical Impact
Successful exploitation allows attackers to execute arbitrary script in an authenticated PRTG user's browser, enabling session theft, credential harvesting, or unauthorized monitoring actions.
Affected Products
- Paessler PRTG Network Monitor versions prior to 25.4.114
- Deployments exposing the PRTG web interface to untrusted networks
- Environments where PRTG administrators or operators may click external links
Discovery Timeline
- 2026-01-14 - CVE-2025-67833 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-67833
Vulnerability Analysis
The vulnerability is a reflected XSS flaw within the PRTG Network Monitor web application. The tag parameter accepts user-supplied input that is reflected back into HTML responses without adequate output encoding or input validation. Because the injection point is reachable without authentication, an attacker only needs to deliver a crafted link to a target user.
The scope-changed characteristic indicates the injected script can affect resources beyond the initial vulnerable component, such as authenticated session cookies or DOM elements belonging to the PRTG management interface. User interaction is required, typically in the form of clicking a malicious link.
Root Cause
The root cause is missing or insufficient contextual output encoding on the tag parameter. Data received from the HTTP request is inserted directly into HTML output without escaping characters such as <, >, ", and '. This allows an attacker to break out of the intended data context and inject executable script.
Attack Vector
Exploitation proceeds over the network via a crafted HTTP GET request. The attacker constructs a URL pointing to the PRTG interface containing a malicious payload in the tag parameter. Delivery typically relies on phishing, malicious advertisements, or embedded links in email. When a logged-in PRTG user visits the link, the injected JavaScript executes with the privileges of that user, enabling actions such as reading session data, modifying monitoring configurations, or issuing API calls on the user's behalf.
No verified public proof-of-concept code is available. See the Paessler Security Vulnerability Advisory for vendor-provided technical details.
Detection Methods for CVE-2025-67833
Indicators of Compromise
- HTTP requests to PRTG endpoints containing tag= parameters with encoded <script>, javascript:, onerror=, or onload= payloads
- Unexpected outbound requests from PRTG operator browsers to attacker-controlled domains following link clicks
- Anomalous configuration changes or API calls originating from legitimate operator sessions
Detection Strategies
- Inspect web server access logs for requests containing suspicious characters in the tag query parameter, such as %3Cscript%3E or event handler attributes
- Deploy Web Application Firewall (WAF) rules to flag reflected XSS patterns targeting PRTG URLs
- Correlate browser-side telemetry with PRTG session activity to identify script execution following external link navigation
Monitoring Recommendations
- Enable and centralize PRTG web server access logging with query string capture
- Alert on requests to PRTG paths that include HTML tags or JavaScript keywords in parameters
- Monitor for PRTG user sessions originating from new IP addresses or user agents shortly after suspicious URL visits
How to Mitigate CVE-2025-67833
Immediate Actions Required
- Upgrade PRTG Network Monitor to version 25.4.114 or later as published in the Paessler advisory
- Restrict access to the PRTG web interface to trusted management networks using firewall or VPN controls
- Instruct PRTG administrators and operators to avoid clicking external links to the PRTG URL and to log out when not actively using the console
Patch Information
Paessler has released a fixed version. Refer to the Paessler Security Vulnerability Advisory for the official patch and upgrade instructions. All installations running versions before 25.4.114 should be updated.
Workarounds
- Place the PRTG web interface behind a reverse proxy or WAF that filters query parameters containing HTML or JavaScript syntax
- Enforce a strict Content Security Policy (CSP) at the proxy layer to limit inline script execution
- Limit PRTG web interface exposure to internal networks and require multi-factor authentication for administrator accounts
# Example WAF rule pattern to block reflected XSS in the tag parameter
# ModSecurity-style rule
SecRule ARGS:tag "@rx (?i)(<script|javascript:|onerror=|onload=|<img|<svg)" \
"id:1006783,phase:2,deny,status:403,msg:'Potential CVE-2025-67833 XSS attempt against PRTG'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
