Paessler PRTG Network Monitor before version 26.2.120.1449 includes a demo VBScript sensor that multiplies two integer parameters using cscript.exe. If a non‑numeric value is passed, the script raises a Type mismatch runtime error that contains the offending parameter value in clear text. PRTG offers a placeholder, %windowspassword, which expands to the configured Windows/domain password. When an attacker passes this placeholder as a sensor argument, the error message reveals the plaintext credential. This flaw results in sensitive credential disclosure rather than code execution or denial of service.

The vulnerability affects Paessler GmbH’s PRTG Network Monitor installations configured with versions earlier than 26.2.120.1449. Any user with write access to create sensors—most non‑read‑only users—can trigger the flaw. Read‑only users or those without sensor‑creation rights are not impacted.

The CVSS score of 7.1 indicates a moderate‑to‑high severity. EPSS data is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widespread public exploitation yet. However, the attack can be performed by any authorized sensor‑creator, making exploitation likely in environments with many privileged users. If compromised, the disclosed credential can grant further access to network resources, potentially allowing lateral movement or full domain compromise.