{"id":"CVE-2023-32782","aliases":["EUVD-2023-37005","GHSA-x5rg-6gf6-5wg5"],"status":"published","title":"An issue was discovered in Paessler PRTG Network Monitor 23.2.83.1760. Due to command-line...","description":"A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","severity":{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.56159,"percentile":0.99056,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-77"],"published":"2023-08-09T00:00:00Z","modified":"2026-06-17T05:59:33Z","products":[{"vendor":"paessler","product":"prtg_network_monitor"}],"references":[{"url":"https://www.paessler.com/prtg/history/stable","tags":["x_transferred","Release Notes"]},{"url":"https://kb.paessler.com/en/topic/91845-multiple-vulnerabilites-fixed-in-paessler-prtg-network-monitor-23-3-86-1520","tags":["x_transferred","Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-32782"},{"url":"https://github.com/advisories/GHSA-x5rg-6gf6-5wg5"}],"sources":{"cve":[{"id":"CVE-2023-32782","description":"A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","status":"published","published":"2023-08-09T00:00:00Z","modified":"2024-10-10T16:16:00.402Z","updated_at":"2026-11-02T14:35:29.01154Z"}],"euvd":[{"id":"EUVD-2023-37005","description":"A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","status":"published","published":"2023-08-09T00:00:00Z","modified":"2024-10-10T16:16:00Z","updated_at":"2026-11-03T00:27:41.012246Z"}],"ghsa":[{"id":"GHSA-x5rg-6gf6-5wg5","title":"An issue was discovered in Paessler PRTG Network Monitor 23.2.83.1760. Due to command-line...","description":"An issue was discovered in Paessler PRTG Network Monitor 23.2.83.1760. Due to command-line parameter injection and an undocumented debug feature flag, an attacker can utilize the DICOM sensor to write arbitrary data to the disk. This can be utilized to write a custom EXE(.bat) sensor, that will then run. This primitive gives remote code execution.","status":"published","published":"2023-08-09T12:30:26Z","modified":"2024-04-04T06:44:24Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:56:44.910366Z"}],"nvd":[{"id":"CVE-2023-32782","description":"A command injection was identified in PRTG 23.2.84.1566 and earlier versions in the Dicom C-ECHO sensor where an authenticated user with write permissions could abuse the debug option to write new files that could potentially get executed by the EXE/Script sensor. The severity of this vulnerability is high and received a score of 7.2 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","status":"published","published":"2023-08-09T12:15:10.127Z","modified":"2026-06-17T05:59:33.94Z","cvss":[{"version":"3.1","score":7.2,"vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:08:22.812138Z"}]}}