CVE-2023-22632: 
PRTG Network Monitor vulnerability analysis and mitigation

CVE-2023-22632 is an arbitrary file write vulnerability in Paessler PRTG Network Monitor affecting all versions before 23.1.82. The flaw exists in the FTP Server Count Sensor component and allows remote attackers with high-level administrative privileges to write to arbitrary files on the system. It carries a CVSS v3.1 base score of 2.7 (Low), reflecting the high privilege requirement that significantly limits the attack surface (GitHub Advisory).

The vulnerability is classified as CWE-88 (Improper Neutralization of Argument Delimiters in a Command — Argument Injection), meaning the FTP Server Count Sensor component fails to properly delimit arguments when constructing commands, enabling an attacker to inject additional parameters that result in unauthorized file write operations. Exploitation requires network access and high-privilege (administrative) credentials on the PRTG management console; no user interaction is needed. The attack complexity is low once the precondition of administrative access is met (GitHub Advisory, Paessler Advisory).

A remote attacker with administrative privileges can write arbitrary files to the underlying system via the FTP Server Count Sensor, which could potentially be chained into remote code execution by overwriting sensitive configuration files, scripts, or web-accessible resources. The CVSS scoring reflects no confidentiality or availability impact, with only a low integrity impact, but the practical risk of arbitrary file write in a network monitoring platform could be elevated if leveraged as part of a broader attack chain (GitHub Advisory).

There is no public proof-of-concept exploit available for CVE-2023-22632, and no evidence of active in-the-wild exploitation has been observed. The EPSS score is 0.0, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The high privilege requirement (administrative access) substantially reduces the likelihood of opportunistic exploitation (GitHub Advisory).

Paessler has released a patch in PRTG Network Monitor version 23.1.82, which resolves this vulnerability. Organizations should upgrade to version 23.1.82 or later as the primary remediation step. As a compensating control, restrict administrative access to the PRTG management console to only trusted, authorized users, and monitor FTP Server Count Sensor activity for any unexpected file write operations (Paessler Advisory, GitHub Advisory).