CVE-2020-11547

What it actually does

The vulnerability permits remote unauthenticated HTTP requests to endpoints such as login.htm or index.htm with a type=probes parameter, exposing probe status, CPU usage, memory statistics, Windows version, and other internal server metrics without requiring authentication.

Why it matters to the business

Attackers can silently collect detailed server and infrastructure information that accelerates reconnaissance and targeted follow-on attacks; the high EPSS score and weaponized exploit maturity increase urgency for the widely deployed PRTG Network Monitor product despite the absence of confirmed ransomware or KEV listings.

How an attack unfolds

An attacker crafts an unauthenticated HTTP GET request to login.htm or index.htm containing the type=probes parameter, receives a response containing sensitive system and probe statistics, then uses the enumerated CPU, memory, OS version, and internal metrics to refine subsequent attacks against the monitoring infrastructure.

How to fix it

Upgrade all instances of PRTG Network Monitor to version 20.1.57.1745 or later; restrict network access to the web interface using firewalls or VPNs until patching is complete.

How to confirm the fix worked

Verify installed version is at least 20.1.57.1745; attempt an unauthenticated request containing type=probes to login.htm and confirm that sensitive statistics are no longer returned.

Typical attack path

1. Locate exposed PRTG Network Monitor web interface via network scanning
2. Issue unauthenticated HTTP request to login.htm or index.htm with type=probes parameter
3. Parse response to extract CPU, memory, Windows version, and probe statistics
4. Leverage gathered intelligence to plan credential attacks, lateral movement, or service disruption

How to detect it

Inspect web server access logs for GET requests to login.htm or index.htm that include the type=probes parameter; correlate any such requests with external source IPs or unusual timing to identify potential reconnaissance activity.

• type=probes
• /login.htm?type=probes
• /index.htm?type=probes
• GET.*login.htm.*type=probes

What your security team should do

• Immediately schedule upgrade to 20.1.57.1745 or newer for all PRTG deployments
• Block or tightly restrict external access to PRTG web ports until patched
• Monitor web logs for requests containing type=probes to login.htm or index.htm
• Review and harden authentication and network segmentation around monitoring servers