What breaks and who should care
If you run Progress WhatsUp Gold you have a serious problem on your hands. CVE-2024-6670 is a SQL‑injection flaw that lets an attacker who can reach the web interface pull the encrypted password of the only user configured in the system. The vulnerability carries a CVSS score of 9.8, placing it in the critical range. It has been confirmed in the wild and is already being used in ransomware campaigns. Any organisation that relies on WhatsUp Gold for network monitoring, especially those that have a single‑user deployment, should treat this as an emergency.
We keep a daily-updated list of vulnerabilities CISA has confirmed as actively exploited, including remediation deadlines.
How the vulnerability works
WhatsUp Gold stores its configuration and user data in a relational database. The vulnerable component accepts a parameter from the web UI and injects it directly into an SQL statement without proper sanitisation. When the application is configured with only one user, the injected query can be crafted to return the encrypted password column for that account. Because the request does not require authentication, anyone who can reach the HTTP/HTTPS endpoint can trigger the injection and retrieve the password blob.
The exact payload is not publicly disclosed, but the underlying class of the bug is classic unauthenticated SQL injection. The attacker does not need valid credentials, does not need to be on the internal network (if the service is exposed), and the impact is limited to password extraction – which in turn can be used to pivot to other systems if the same credentials are reused.
Am I affected?
First, confirm you are running WhatsUp Gold. Then check two things:
- Is the product version older than the patched release for your branch? The table below lists the versions that are vulnerable and the version where the fix was introduced. If your version appears in the vulnerable column, you are at risk.
- Is the application configured with only a single user account? The vulnerability only triggers when there is exactly one user defined.
To verify the installed version on a Windows host, open PowerShell and run:
Get-ItemProperty -Path "HKLM:\Software\Progress\WhatsUp Gold" | Select-Object -Property DisplayVersionAlternatively, launch the WhatsUp Gold console and open the *Help → About* dialog – the version number is displayed there.
To check how many users are defined, log into the web UI, navigate to *Administration → Users*, and count the entries. If you only see the default admin account, you fall into the vulnerable configuration.
How bad is it really?
The CVSS base score of 9.8 reflects the ease of exploitation (no authentication required) and the confidentiality impact (password disclosure). The fact that it is already being used by ransomware groups means the threat is not theoretical. An attacker who extracts the encrypted password can attempt to crack it offline, or, if the same credential is used elsewhere, gain lateral movement. In practice the impact ranges from credential theft to full system compromise, depending on your password hygiene and network segmentation.
Because the flaw does not allow arbitrary command execution, the immediate damage is limited to credential exposure. However, in a typical monitoring environment the credentials often have broad read‑write rights, making the downstream risk significant.
What you can do right now
Step 1 – Verify exposure
Run the PowerShell command above to see your version. Cross‑reference it with the table below. Then confirm you have only one user. If either check shows you are vulnerable, move to the next step without delay.
Step 2 – Apply the vendor patch
Progress has released a patched build that removes the unsafe SQL handling. The fix is included in the latest release for each supported branch. Upgrade to the patched release for your branch as soon as possible. The upgrade process is the same as any normal product update: download the installer from the Progress portal, run it on the server, and follow the on‑screen prompts. No manual database changes are required – the installer will replace the vulnerable component and restart the service.
After upgrading, repeat the version check to ensure the new build is now listed in the “fixed” column of the table below. Also, verify that the service starts without errors and that monitoring continues as expected.
Step 3 – Apply mitigations if you cannot patch immediately
If you cannot apply the update right away (for example, because of change‑control windows), you must reduce the attack surface:
- Restrict network access. Use firewall rules to allow only trusted IP ranges to reach the WhatsUp Gold web interface. Block any traffic from the internet.
- Enable multi‑factor authentication. If the product supports it, require a second factor for any login. This does not stop the injection itself, but it makes the stolen password harder to reuse.
- Add a second user. Create an additional administrative account. The vulnerability only works when a single user exists, so adding a second account breaks the exploit path.
- Deploy a web‑application firewall (WAF). Configure the WAF to block typical SQL‑injection patterns on the WhatsUp Gold endpoint. While not a perfect fix, it adds a layer of defence.
Document the temporary controls you have applied and set a deadline to apply the official patch.
Step 4 – If a patch is unavailable
Should you find yourself in a situation where the vendor cannot provide a patched build for your specific deployment (for example, an end‑of‑life branch), you have two options:
- Take the product offline. Shut down the WhatsUp Gold service, remove it from any external network exposure, and replace its monitoring function with an alternative tool.
- Isolate the host completely. Keep the service running only on an internal, air‑gapped network segment that no untrusted users can reach.
Both approaches eliminate the attack vector but may impact your monitoring capabilities. Weigh the operational impact against the risk of credential theft.
What to do after you have patched
Once the patched version is in place, perform a quick sanity check:
- Restart the WhatsUp Gold service and confirm it reports the expected version.
- Run a basic vulnerability scan against the host to ensure the CVE no longer appears.
- Review your user accounts. If you added a second account as a mitigation, consider cleaning up any unused accounts.
Finally, update your incident‑response documentation to reflect that this vulnerability has been addressed. Record the date of the upgrade, the version you moved to, and any temporary controls you applied. This will make future audits smoother.
Summary
CVE-2024-6670 is a critical, unauthenticated SQL‑injection flaw in Progress WhatsUp Gold that lets an attacker pull the encrypted password when only one user is configured. It is actively exploited and linked to ransomware. The fix is available – upgrade to the patched release for your branch. If you cannot patch immediately, restrict access, add a second user, enable MFA, and consider a WAF. If no patch exists for your deployment, isolate or discontinue the product. Act now; the longer the vulnerable version remains in use, the higher the chance of compromise.
Check the table below to see whether your version is vulnerable and to confirm you have moved to a safe release.
Affected versions
Straight from the NVD record for CVE-2024-6670. If your build is inside one of these ranges, treat it as vulnerable.
| Product | Affected range | Fixed in |
|---|---|---|
whatsup_gold |
* up to 24.0 | 24.0 |
