A directory traversal vulnerability in Paessler PRTG Network Monitor allows unauthenticated remote attackers to gain unauthorized access to sensitive local files on the server.

This is a relative path traversal vulnerability (CWE-23) that allows an unauthenticated, remote attacker to bypass file access controls. By sending specially crafted requests, an attacker can read files outside of the intended directory, potentially exposing configuration files or system credentials.

Successful exploitation of this vulnerability poses a severe risk to organizational security, as it allows for the unauthorized disclosure of sensitive data stored on the PRTG server. Given the CVSS score of 8.6, this is classified as a high-severity risk that could lead to full system compromise if sensitive configuration files or credentials are harvested. Such a breach could result in significant reputational damage, operational disruption, and the loss of confidential network infrastructure information.

Immediate Action: Upgrade Paessler PRTG Network Monitor to version 23.4.88.1429 or later to fully remediate the directory traversal flaw.

Proactive Monitoring: Review web server and application access logs for anomalous requests containing directory traversal sequences, such as dot-dot-slash patterns, directed at the PRTG application.

Compensating Controls: Deploy a Web Application Firewall (WAF) with rules configured to detect and block path traversal attempts targeting the PRTG web interface until the software can be patched.

Public Exploit Available: No

Due to the unauthenticated nature of this vulnerability and the potential for severe data exposure, administrators must prioritize the update of all PRTG Network Monitor instances. Apply the vendor-supplied security update to version 23.4.88.1429 immediately to mitigate the risk of unauthorized file access and potential system compromise.