CVE-2018-19410: PRTG Network Monitor unauthenticated local file inclusion enables admin user creation

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 16 September 2026. Confidence: high.

critical priorityPre-authentication remote code and privilege escalation with CVSS 9.8, active KEV listing and near-maximum EPSS probability make this an urgent patch.

What it is

PRTG Network Monitor before 18.2.40.1683 lets an unauthenticated remote attacker abuse the 'include' directive in /public/login.htm to perform local file inclusion and execute /api/addusers. By supplying the 'id' and 'users' parameters, the attacker creates a user with read-write privileges, including administrator. This is a critical pre-auth flaw in a widely deployed monitoring product.

Impact

An attacker gains a fully privileged account on the PRTG instance, enabling configuration changes, access to monitored data and potential lateral movement into managed infrastructure. No existing credentials are needed.

Attack surface

Reachable over the network via HTTP requests to /public/login.htm and /api/addusers; the CVSS vector shows no privileges and no user interaction required. The flaw is in the web interface's handling of the 'include' directive.

Exploitation

Listed in CISA KEV with a 2025-02-04 addition and a 2025-02-25 remediation due date, and EPSS 30-day probability is 0.979 (99.9th percentile), indicating active exploitation and high likelihood. Reference tags are third-party advisory and US government resource only; no public exploit code is cited in the record.

What to do

• Upgrade PRTG Network Monitor to 18.2.40.1683 or later; this is the vendor fix and takes precedence over all other actions.
• If immediate upgrade is not possible, restrict network access to the PRTG web interface to trusted management networks and discontinue use if no mitigation is available, per CISA guidance.
• Audit PRTG user accounts for unexpected read-write or administrator accounts and remove any that are not authorized.
• Place the PRTG web interface behind an authenticating reverse proxy or VPN so unauthenticated requests cannot reach /public/login.htm.
• Monitor vendor and CISA advisories for updated guidance given the KEV listing.

Detection

• Review PRTG web server logs for requests to /public/login.htm containing 'include' parameters referencing /api/addusers or other internal paths.
• Alert on POST or GET requests to /api/addusers from unauthenticated or unexpected source IPs.
• Monitor PRTG user creation events and alert on new accounts with read-write or administrator privileges.
• Correlate PRTG access logs with authentication logs to find privileged actions lacking a preceding successful login.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.