SOC status:Duty analyst on shift

UK Cyber Defence
VulnerabilityAnalyzed

CVE-2024-4885

Progress WhatsUp Gold Path Traversal Vulnerability

KEVCRITICAL 9.8EPSS 99.3%

Does this matter?

Known to be exploited in the wild (CISA KEV, CISA remediation deadline 24 March 2025). Treat as an emergency change: patch or isolate now, then hunt for prior compromise.

Description

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

CVSS 3.1
9.8 CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
99.29% probability · 100th percentile
CISA KEV
Listed 3 March 2025 · due 24 March 2025
Weakness
CWE-22
Affected
progress/whatsup gold
Source
security@progress.com

CISA notes

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 ; https://nvd.nist.gov/vuln/detail/CVE-2024-4885

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.