CVE-2021-34547: 
PRTG Network Monitor vulnerability analysis and mitigation

PRTG Network Monitor version 20.1.55.1775 contains a Cross-Site Request Forgery (CSRF) vulnerability that allows attackers to create user accounts through the /editsettings endpoint. The vulnerability was discovered on June 10, 2021, and was assigned CVE-2021-34547 (MITRE CVE).

The vulnerability exists due to the lack of anti-CSRF token implementation throughout the PRTG Network Monitor application. This security flaw allows attackers to create and submit HTML forms that trigger user account creation requests on behalf of authenticated users (GitHub POC).

When successfully exploited, this vulnerability allows attackers to perform actions on behalf of authenticated users, particularly the creation of unauthorized user accounts. If the victim is an administrator, the attacker could create administrative accounts, potentially leading to complete system compromise (GitHub POC).

The vulnerability can be exploited by creating a malicious HTML form that submits user account creation requests. The attacker needs to trick an authenticated user (preferably an administrator) into clicking a malicious link or visiting a crafted webpage while having an active session in the PRTG Network Monitor (GitHub POC).