CVE-2015-7743 Paessler CVE debrief

Who should care

Administrators and security teams running Paessler PRTG Network Monitor, especially where authenticated users can create or manage sensors. Environments that expose PRTG to broader internal user populations should prioritize review.

Technical summary

The supplied NVD record classifies this as CWE-611 (XXE) with CVSS 3.0 vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N. The described attack path is remote and authenticated: an attacker creates an HTTP XML/REST Value sensor that references a crafted XML file, enabling arbitrary file reads through entity expansion. The corpus contains a version-scope discrepancy: the CVE description references a fix before 16.2.23.3077/3078, while the NVD CPE criteria in the supplied record marks versions through 14.4.12.3282 as vulnerable. Use the vendor history reference to validate the upgrade target for your installed branch.

Defensive priority

Medium-high. The issue is remotely reachable and can expose sensitive file contents, but it requires authentication and the provided CVSS vector does not indicate integrity or availability impact.

Recommended defensive actions

• Upgrade PRTG Network Monitor to a fixed release identified by Paessler’s stable history reference around 16.2.23.3077/3078.
• Restrict sensor creation and XML/REST-related configuration permissions to trusted administrators only.
• Review existing HTTP XML/REST Value sensors for unexpected or untrusted XML sources.
• Inventory deployed PRTG versions and compare them against the affected-version information in both the CVE description and Paessler’s history page.
• Monitor for unusual file-access patterns or configuration changes by authenticated PRTG users.
• If custom XML integrations are used, confirm external entity processing is disabled or otherwise safely handled where applicable.

Evidence notes

The supplied CVE description states that remote authenticated users can read arbitrary files by creating a new HTTP XML/REST Value sensor that accesses a crafted XML file. The NVD record supplied with the corpus assigns CWE-611 and CVSS 3.0 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N, and the reference list includes Paessler’s stable history page around 16.2.23.3077/3078 as the vendor remediation marker. The same NVD record’s CPE criteria also lists vulnerability through 14.4.12.3282, so the exact affected range should be validated against the vendor reference.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.