Vulnerability record · CVE-2020-11547 · published 5 April 2020
CVE-2020-11547: PRTG Network Monitor unauthenticated information disclosure via HTTP request
Paessler · Prtg Network Monitor
PRTG Network Monitor before 20.1.57.1745 exposes server and probe details to unauthenticated remote users through HTTP requests such as type=probes to login.htm or index.htm. The flaw is a missing authentication check (CWE-306) on a function that returns CPU usage, memory, Windows version and internal statistics. It matters because reconnaissance data is available without credentials, easing follow-on targeting of the monitoring infrastructure.
Description
PRTG Network Monitor before 20.1.57.1745 allows remote unauthenticated attackers to obtain information about probes running or the server itself (CPU usage, memory, Windows version, and internal statistics) via an HTTP request, as demonstrated by type=probes to login.htm or index.htm.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Automated analysis
medium priorityThe flaw is remotely exploitable without authentication but only discloses information, with no confirmed public exploit or KEV listing.
What it is
PRTG Network Monitor before 20.1.57.1745 exposes server and probe details to unauthenticated remote users through HTTP requests such as type=probes to login.htm or index.htm. The flaw is a missing authentication check (CWE-306) on a function that returns CPU usage, memory, Windows version and internal statistics. It matters because reconnaissance data is available without credentials, easing follow-on targeting of the monitoring infrastructure.
Impact
An attacker gains internal operational details about the PRTG server and its probes, including resource usage, OS version and statistics. This is information disclosure only; the CVSS vector shows no integrity or availability impact.
Attack surface
Reachable over the network via HTTP requests to login.htm or index.htm with parameters such as type=probes. No authentication and no user interaction are required per the CVSS vector (AV:N/AC:L/PR:N/UI:N).
Exploitation
Not listed in CISA KEV and no ransomware association is recorded. EPSS is high (0.52059, 98.9th percentile), but the only references are marked Broken Link, so no public exploit code is confirmed by this record.
What to do
- Upgrade PRTG Network Monitor to version 20.1.57.1745 or later.
- Restrict network access to the PRTG web interface to trusted management networks.
- Place the PRTG interface behind authentication-aware reverse proxy or VPN where feasible.
- Monitor for unauthenticated requests using parameters such as type=probes against login.htm and index.htm.
Detection
- Search web logs for requests to login.htm or index.htm containing type=probes from unauthenticated sources.
- Alert on access to PRTG management endpoints from IPs outside expected administrative ranges.
- Baseline normal PRTG web request patterns and flag anomalous parameter usage.
This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.
Affected products
1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
References
Track CVE-2020-11547 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2020-11547), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
