CVE-2023-32782

Deeper analysis

CVE-2023-32782 is a command injection vulnerability, tracked under CWE-77, that affects the Dicom C-ECHO sensor in Paessler PRTG Network Monitor 23.2.84.1566 and earlier releases. The flaw allows an authenticated user with write permissions to misuse the sensor's debug option, resulting in the creation of new files that can subsequently be executed through the EXE/Script sensor. It carries a CVSS 3.1 base score of 7.2 with a network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.

An attacker who already possesses the required account privileges can leverage the debug functionality to inject commands that write arbitrary files to the system. These files may then be invoked by the EXE/Script sensor, enabling the attacker to execute code and achieve full control over affected monitoring instances.

Paessler addressed the issue, along with other vulnerabilities, in PRTG version 23.3.86.1520. The vendor's knowledge base article and release history page recommend upgrading to the patched build to eliminate the exposure. The associated EPSS score has remained flat at 0.2563 with no material increase since disclosure.