CVE-2018-19410 Paessler PRTG Network Monitor Local File Inclusion

Exploited in the wild Critical 9.8 Published 21 Nov 2018 Updated 21 Oct 2025

Unauthenticated attackers can bypass authentication via Local File Inclusion to create administrator accounts, leading to full system compromise.

Exploited in the wild: Since 4 Feb 2025
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2018-19410?

CVE-2018-19410 is a critical authentication bypass vulnerability in n/a, published on 21 Nov 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

PRTG Network Monitor before 18.2.40.1683 allows remote unauthenticated attackers to create users with read-write privileges (including administrator). A remote unauthenticated user can craft an HTTP request and override attributes of the 'include' directive in /public/login.htm and perform a Local File Inclusion attack, by including /api/addusers and executing it. By providing the 'id' and 'users' parameters, an unauthenticated attacker can create a user with read-write privileges (including administrator).

Which versions are affected by CVE-2018-19410?

It affects 1 product.

Products include Paessler Prtg Network Monitor.

How do I fix CVE-2018-19410?

No fix has been published for CVE-2018-19410 yet. Limit exposure of the affected software until one is available. US federal agencies must fix it by 25 Feb 2025.

Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.

Is CVE-2018-19410 being exploited?

Yes. Attackers have exploited CVE-2018-19410 in the wild since at least 4 Feb 2025.

Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.

Sources

Also known as GHSA-pm93-g4gf-j42f.