CVE-2023-32782

What it actually does

CVE-2023-32782 is an authenticated command-injection/file-write abuse path in Paessler PRTG Network Monitor 23.2.84.1566 and earlier, specifically involving the Dicom C-ECHO sensor debug functionality. A user who already has high privileges and write permissions in PRTG can abuse the debug option to create files in locations where PRTG sensors may later execute them, such as through EXE/Script sensor functionality. Successful exploitation can result in arbitrary code execution in the context of the PRTG probe or service account, with potential compromise of monitored credentials, sensor data, integrations, and the underlying Windows host.

Why it matters to the business

An attacker who already has significant access to PRTG can turn that access into control of the monitoring server or probe, potentially disrupting monitoring, stealing stored credentials or secrets used by sensors, tampering with alerts, and using the monitoring platform as a pivot point into other systems. Because PRTG often has broad visibility and privileged connectivity across infrastructure, compromise can have outsized operational impact even though exploitation requires authenticated high-privilege access. The EPSS score is relatively elevated, indicating meaningful exploitation likelihood compared with many vulnerabilities, but this issue is not currently listed in CISA KEV and is not known from the provided data to be ransomware-associated.

How an attack unfolds

An attacker first obtains or abuses a PRTG account with sufficient write privileges to configure sensors or related settings. The attacker then targets the Dicom C-ECHO sensor and enables or manipulates its debug behavior so that attacker-controlled content is written to disk. If the written content is placed where PRTG treats it as an executable or script sensor payload, the attacker can cause PRTG’s EXE/Script sensor mechanism to run it. Execution occurs under the account used by the PRTG probe/service, which may provide access to local system resources, monitoring credentials, network reachability, and downstream administrative integrations. After execution, the attacker may establish persistence, collect credentials stored or accessible to PRTG, alter monitoring behavior, or pivot to systems monitored by PRTG.

How to fix it

Upgrade Paessler PRTG Network Monitor to a vendor-supported release newer than 23.2.84.1566 that contains the vendor fix for this issue. If exact fixed package versions are not tracked internally, upgrade to the latest available PRTG release from Paessler. Until upgrading is complete, restrict PRTG administrative and write permissions to trusted administrators only, disable or tightly control Dicom C-ECHO sensor debug functionality, review and limit use of EXE/Script sensors, and restrict write access to PRTG custom sensor directories. Run PRTG probe services with the least privilege required, segment PRTG from general user networks, and monitor changes to custom sensor folders and sensor definitions.

How to confirm the fix worked

Confirm all PRTG core servers and probes report a version later than 23.2.84.1566 or the current vendor-supported fixed release. Inventory Dicom C-ECHO sensors and verify debug options are disabled unless explicitly required. Review configured EXE/Script sensors and confirm every executable or script in custom sensor directories is expected, signed or otherwise approved, and has a known owner. Validate filesystem ACLs on PRTG custom sensor directories to ensure only trusted administrators can write there. Test that non-administrative PRTG users cannot create or modify sensors in ways that write executable content to script sensor locations. Review recent sensor configuration changes and file creation events around PRTG directories for unexpected activity.

Typical attack path

1. Gain authenticated access to PRTG with high privileges and write permissions.
2. Identify a PRTG instance running version 23.2.84.1566 or earlier.
3. Create or modify a Dicom C-ECHO sensor and abuse its debug option to write attacker-controlled content to disk.
4. Place or cause the content to appear in a location used by EXE/Script sensor execution.
5. Trigger or wait for the EXE/Script sensor to execute the attacker-controlled file.
6. Run commands under the PRTG probe/service account context.
7. Use the compromised monitoring server or probe to access credentials, tamper with monitoring, or pivot to other reachable systems.

How to detect it

To determine whether exploitation already occurred, review PRTG audit logs, system logs, EDR telemetry, and filesystem events for suspicious sensor changes and file writes. Focus on the period before and after any Dicom C-ECHO sensor creation or modification, especially where debug settings were enabled. Examine PRTG custom sensor directories for newly created or modified scripts, executables, batch files, PowerShell files, or renamed binaries. Correlate those file writes with executions by PRTG probe processes and any unusual child processes such as cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe, rundll32.exe, certutil.exe, curl.exe, or bitsadmin.exe. Review Windows Security logs for process creation if enabled, Sysmon Event ID 1 for process execution, Sysmon Event ID 11 for file creation, Sysmon Event ID 15 for file stream creation, and Sysmon Event ID 22 for suspicious DNS activity from the PRTG host. Review PRTG logs for sensor configuration changes involving Dicom C-ECHO, EXE/Script, EXE/Script Advanced, debug output, and custom sensor paths. If suspicious execution is found, preserve the relevant scripts/binaries, collect hashes, review outbound network connections from the PRTG host, inspect scheduled tasks/services/startup folders for persistence, and rotate credentials accessible to PRTG.

• C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXE\
• C:\Program Files (x86)\PRTG Network Monitor\Custom Sensors\EXEXML\
• C:\Program Files\PRTG Network Monitor\Custom Sensors\EXE\
• C:\Program Files\PRTG Network Monitor\Custom Sensors\EXEXML\
• C:\ProgramData\Paessler\PRTG Network Monitor\Logs (Sensors)\
• C:\ProgramData\Paessler\PRTG Network Monitor\Logs (System)\
• Dicom C-ECHO
• EXE/Script
• EXE/Script Advanced
• PRTG Probe.exe
• PRTG Server.exe
• PRTG Probe.exe -> cmd.exe
• PRTG Probe.exe -> powershell.exe
• PRTG Probe.exe -> wscript.exe
• PRTG Probe.exe -> cscript.exe
• PRTG Probe.exe -> mshta.exe
• PRTG Probe.exe -> certutil.exe
• PRTG Probe.exe -> bitsadmin.exe
• PRTG Probe.exe -> curl.exe
• .ps1
• .bat
• .cmd
• .vbs
• .js
• .exe

What your security team should do

• Prioritize upgrading all PRTG installations and probes running 23.2.84.1566 or earlier to the latest fixed vendor release.
• Immediately audit PRTG users, roles, API users, and service accounts; remove unnecessary write or administrative permissions.
• Review all Dicom C-ECHO sensors for debug usage and disable debug settings unless there is a documented operational need.
• Review all EXE/Script and EXE/Script Advanced sensors for unexpected scripts, binaries, command wrappers, or recent modifications.
• Enable filesystem auditing or EDR monitoring on PRTG custom sensor directories, especially EXE and EXEXML paths.
• Investigate recent file creation, modification, or execution events by PRTG probe/service processes in custom sensor directories.
• Rotate credentials stored in or used by PRTG if exploitation is suspected, especially credentials with administrative reach into monitored systems.
• Segment PRTG servers and probes so compromise of the monitoring platform cannot easily pivot into unrelated infrastructure.
• Alert on unusual child processes spawned by PRTG services, including command shells, scripting engines, download tools, and archive utilities.