Progress Software fixed 2 new critical flaws in WhatsUp Gold

Progress WhatsUp Gold releases before 2024.0.1 contain a critical vulnerability that allows a remote, unauthenticated attacker to execute code in the context of the WhatsUp Gold service account; the associated weaknesses (CWE-16 configuration, CWE-22 path traversal, CWE-73 externally controlled file path) point to a file-path handling flaw. It is triggered over the network with no credentials, no special conditions, and no user interaction, which is why it scores 9.8 (critical) on CVSS 3.1. Successful exploitation gives an attacker code execution as the service account, which typically runs with high local privileges on the monitoring server and often holds credentials for the devices and networks being monitored. All deployments running any WhatsUp Gold version prior to 2024.0.1 are affected. No public proof-of-concept or CISA KEV listing is known, but the elevated EPSS score (48.9% probability of exploitation within 30 days, 99th percentile) suggests exploitation attempts are likely soon.

Do: Upgrade to WhatsUp Gold 2024.0.1 or later, which the vendor shipped alongside several other WhatsUp Gold fixes. If upgrading is delayed, restrict access to the WhatsUp Gold web interface to trusted management networks and review the privileges of the account under which the service runs. Because these servers frequently store credentials for monitored devices, treat them as high-value and check for indicators of compromise.

CVE-2024-6670 is a critical (CVSS 9.8) SQL injection flaw (CWE-89) in Progress Software's WhatsUp Gold network monitoring product, affecting all versions released before 2024.0.0. An unauthenticated attacker can trigger the flaw with crafted requests sent to the product over the network, requiring no privileges or user interaction. Successful exploitation lets the attacker retrieve WhatsUp Gold users' encrypted passwords, which can then potentially be cracked offline to gain valid credentials for further compromise. All organizations running affected releases — especially those with the WhatsUp Gold interface reachable beyond trusted internal networks — are exposed, and the flaw is one of two critical WhatsUp Gold issues Progress fixed in the 2024.0.0 release. CISA added it to the Known Exploited Vulnerabilities catalog on 2024-09-16 with confirmed ransomware use, and EPSS assigns a ~93% probability of exploitation within 30 days, though no public proof-of-concept is catalogued for this flaw.

Do: Upgrade to WhatsUp Gold 2024.0.0 or later, the release that fixes this flaw; per CISA's KEV requirement, apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Because the flaw exposes encrypted user passwords, reset WhatsUp Gold credentials after patching and review logs for signs of exploitation, given known ransomware use.