Paessler PRTN Network Monitor < 18.2.39 Multiple Vulnerabilities

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(277615);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2025/12/17");

  script_cve_id("CVE-2018-9276", "CVE-2018-9278");
  script_xref(name:"CISA-KNOWN-EXPLOITED", value:"2025/02/25");

  script_name(english:"Paessler PRTN Network Monitor < 18.2.39 Multiple Vulnerabilities");

  script_set_attribute(attribute:"synopsis", value:
"The remote host is missing a security update.");
  script_set_attribute(attribute:"description", value:
"The version of Paessler PRTG Network Monitor installed on the remote host is prior to 18.2.39. It is, therefore,
affected by multiple vulnerabilities:

  - An issue was discovered in PRTG Network Monitor before 18.2.39. An attacker who has access to the PRTG System
    Administrator web console with administrative privileges can exploit an OS command injection vulnerability (both on
    the server and on devices) by sending malformed parameters in sensor or notification management scenarios.
    (CVE-2018-9276)

  - A potential security issue with sample custom notifications. (CVE-2018-9278)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://www.paessler.com/prtg/history/prtg-18#18.2.39
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?8b502e62");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Paessler PRTG Network Monitor version 18.2.39 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:S/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:F/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:F/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2018-9276");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");
  script_set_attribute(attribute:"metasploit_name", value:'PRTG Network Monitor Authenticated RCE');
  script_set_attribute(attribute:"exploit_framework_metasploit", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2018/04/20");
  script_set_attribute(attribute:"patch_publication_date", value:"2018/04/20");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/12/08");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:paessler:prtg_network_monitor");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Windows");

  script_copyright(english:"This script is Copyright (C) 2025 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("paessler_prtg_network_monitor_win_installed.nbin");
  script_require_keys("SMB/Registry/Enumerated", "installed_sw/Paessler PRTG Network Monitor");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'requires': [
        {'scope': 'target', 'match': {'os': 'windows'}}
  ],
  'checks': [
    {
      'product': {'name': 'Paessler PRTG Network Monitor', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version' : '18.2.39'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);