Active Exploitation of Critical Progress WhatsUp Gold Vulnerability

Progress has released security updates to address a critical vulnerability (CVE-2024-4885) in WhatsUp Gold, a network monitoring application. The vulnerability has a Common Vulnerability Scoring System (CVSSv3.1) score of 9.8 out of 10 and is reportedly being actively exploited.

Successful exploitation of the vulnerability may allow an unauthenticated attacker to perform remote code execution (RCE) as a service account with elevated permissions through NmAPI.exe.

This vulnerability affects Progress WhatsUp Gold versions from 23.1.2 and older.

Users and administrators of affected product versions are advised to update to the latest version immediately. 

Administrators are also advised to monitor exploitation attempts at the'/NmAPI/RecurringReport' endpoint and implement firewall rules to restrict access to trusted IP addresses on ports 9642 and 9643.

More information is available here:

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024

https://summoning.team/blog/progress-whatsup-gold-rce-cve-2024-4885/