CVE-2023-32781

EPSS 12.3%

Vexday Risk Score

23Low

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Functional exploit

Automatable exploit available (Nuclei/Metasploit).

CVSS —EPSS 12.3%KEV nãoPoC —Nuclei —Metasploit simPatch —

Lifecycle

09 Aug 2023Metasploit module available

09 Aug 2023Published on NVD

Weaponization speed

same dayto Metasploit module

Weaponized quickly — attackers prioritized this vulnerability. Patch urgently.

Recommendation: Plan a near-term fix — a public PoC already exists.

A command injection vulnerability was identified in PRTG 23.2.84.1566 and earlier versions in the HL7 sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected products

n/a · n/a

References

http://packetstormsecurity.com/files/176677/PRTG-Authenticated-Remote-Code-Execution.html https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520 https://www.paessler.com/prtg/history/stable