CVE-2023-22631: 
PRTG Network Monitor vulnerability analysis and mitigation

CVE-2023-22631 is an arbitrary file write vulnerability in Paessler PRTG Network Monitor affecting all versions before 23.1.82. The flaw allows remote attackers with high-privilege authentication to write to files on the system via the HTTP XML/REST Sensor component. It carries a CVSS v3.1 base score of 2.7 (Low) (GitHub Advisory), though the potential attack chain (arbitrary file write to code execution) may represent a higher practical risk than the score suggests (Paessler Helpdesk).

The vulnerability is classified under CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection), indicating that the HTTP XML/REST Sensor fails to properly sanitize or delimit arguments passed to an underlying command or file operation (GitHub Advisory). An attacker exploiting this flaw must be authenticated with high privileges (e.g., administrator-level access) and can craft malicious requests to the HTTP XML/REST Sensor to write arbitrary content to files on the PRTG host system. The attack vector is network-based, requires no user interaction, and has low attack complexity once the attacker has the required credentials. The practical risk is elevated because arbitrary file write primitives can potentially be chained to achieve remote code execution (Feedly).

Successful exploitation allows an authenticated high-privilege attacker to write to arbitrary files on the PRTG Network Monitor host, resulting in a low integrity impact with no direct confidentiality or availability impact per the CVSS scoring (GitHub Advisory). However, the ability to write files can be leveraged to escalate impact — for example, by overwriting configuration files, planting web shells, or modifying scripts executed by the PRTG service, potentially leading to full system compromise (Feedly). The scope is limited to the PRTG host system itself, but given PRTG's role as a network monitoring platform with broad access to network infrastructure credentials and data, a compromised instance could facilitate lateral movement.

There is no public proof-of-concept exploit code and no evidence of in-the-wild exploitation reported at this time (Feedly). The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high-privilege (administrator) authentication, which significantly limits the attacker pool and reduces practical exploitability.

Paessler has released a patch in PRTG Network Monitor version 23.1.82, and upgrading to this version or later is the recommended remediation (Paessler Helpdesk). As a workaround, administrators should restrict access to the HTTP XML/REST Sensor to only trusted administrators and implement network-level access controls (e.g., firewall rules, VPN requirements) to limit exposure of the PRTG web interface. Enforcing the principle of least privilege for PRTG accounts and monitoring for unexpected file modifications on the PRTG host are also recommended defensive measures.

Paessler published a dedicated helpdesk article addressing both CVE-2023-22631 and the related CVE-2023-22632, confirming the vulnerability and providing guidance to customers (Paessler Helpdesk). No significant broader community or media discussion has been identified for this vulnerability, consistent with its low CVSS score and lack of public exploitation.