9.8
CRITICAL
CVE-2024-4885
Progress WhatsUpGold Remote Code Execution Vulnerability
Description

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

INFO

Published Date :

June 25, 2024, 8:15 p.m.

Last Modified :

Nov. 21, 2024, 9:43 a.m.

Remotely Exploitable :

Yes !

Impact Score :

5.9

Exploitability Score :

3.9
Public PoC/Exploit Available at Github

CVE-2024-4885 has a 3 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

Affected Products

The following products are affected by CVE-2024-4885 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID Vendor Product Action
1 Progress whatsup_gold
References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-4885.

URL Resource
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 Vendor Advisory
https://www.progress.com/network-monitoring Product
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 Vendor Advisory
https://www.progress.com/network-monitoring Product

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

Exploit for CVE-2024-4885

Python ASP.NET

Updated: 6 days, 1 hour ago
16 stars 4 fork 4 watcher
Born at : July 8, 2024, 12:14 p.m. This repo has been linked 1 different CVEs too.

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

cisa-kev vulnerability 0day cisa exploits

Updated: 2 days, 23 hours ago
546 stars 34 fork 34 watcher
Born at : April 19, 2022, 8:58 a.m. This repo has been linked 1221 different CVEs too.

📡 PoC auto collect from GitHub. ⚠️ Be careful Malware.

security cve exploit poc vulnerability

Updated: 2 days, 16 hours ago
6560 stars 1141 fork 1141 watcher
Born at : Dec. 8, 2019, 1:03 p.m. This repo has been linked 968 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-4885 vulnerability anywhere in the article.

  • The Cyber Express
Quantum Computing: Revolutionizing Cybersecurity Risks and Solutions

Quantum computing revolutionizes various fields, leveraging the unique properties of quantum mechanics. Its impact on cybersecurity, however, presents both significant risks and opportunities. Traditi ... Read more

Published Date: Sep 23, 2024 (2 months, 1 week ago)
  • The Hacker News
Progress WhatsUp Gold Exploited Just Hours After PoC Release for Critical Flaw

Software Security / Threat Intelligence Malicious actors are likely leveraging publicly available proof-of-concept (PoC) exploits for recently disclosed security flaws in Progress Software WhatsUp Gol ... Read more

Published Date: Sep 13, 2024 (2 months, 3 weeks ago)
  • BleepingComputer
Hackers targeting WhatsUp Gold with public exploit since August

Hackers have been leveraging publicly available exploit code for two critical vulnerabilities in the WhatsUp Gold network availability and performance monitoring solution from Progress Software. The t ... Read more

Published Date: Sep 12, 2024 (2 months, 3 weeks ago)
  • Trend Micro
Protecting Against RCE Attacks Abusing WhatsUp Gold Vulnerabilities

Summary Trend Micro researchers identified remote code execution attacks on WhatsUp Gold exploiting the Active Monitor PowerShell Script since August 30. These attacks possibly leveraged vulnerabiliti ... Read more

Published Date: Sep 12, 2024 (2 months, 3 weeks ago)
  • The Cyber Express
High-Risk Vulnerabilities Discovered in Zyxel Firewalls: What You Need to Know

Zyxel Networks has recently issued a critical alert regarding several high-risk vulnerabilities affecting their firewall products. This warning comes as part of a broader security advisory that highli ... Read more

Published Date: Sep 04, 2024 (3 months ago)
  • The Cyber Express
Cyberattack Hits Shoshone-Bannock Tribes: Key Services Unaffected, Recovery in Progress

The Shoshone-Bannock Tribes have confirmed a cybersecurity incident that disrupted their operations on the Fort Hall Reservation in Idaho. The Shoshone-Bannock Tribes cyberattack, reported on August 2 ... Read more

Published Date: Sep 03, 2024 (3 months ago)
  • The Cyber Express
North Korean Hackers Exploited Chromium Zero-Day to Deploy Rootkit

In a recent attack, a North Korean threat actor leveraged a zero-day vulnerability in Google’s Chromium browser to deploy the FudModule rootkit, targeting cryptocurrency firms for financial gain. Micr ... Read more

Published Date: Aug 30, 2024 (3 months ago)
  • The Cyber Express
Cyberespionage Threat: APT-C-60 Targets East Asia with SpyGlace

A sophisticated cyberespionage campaign targeting East Asian countries has been uncovered, with the APT-C-60 group exploiting a zero-day vulnerability in WPS Office to deploy the notorious SpyGlace ba ... Read more

Published Date: Aug 30, 2024 (3 months ago)
  • The Cyber Express
Critical Vulnerabilities in Progress Software’s WhatsUp Gold Expose Systems to Severe Risks

Recent security findings reveal that Progress Software’s WhatsUp Gold, a prominent enterprise network monitoring and management solution, harbors significant vulnerabilities that could lead to full sy ... Read more

Published Date: Aug 30, 2024 (3 months ago)
  • The Cyber Express
Massive Mirai Botnet Exploited Zero-Day Vulnerability in AVTECH Cameras

Researchers have discovered a botnet campaign that is exploiting several vulnerabilities, including a zero-day vulnerability (CVE-2024-7029) in AVTECH closed-circuit television (CCTV) cameras that cou ... Read more

Published Date: Aug 30, 2024 (3 months ago)
  • The Cyber Express
Russian State Hackers Using Exploits ‘Strikingly Similar’ to Spyware Vendors NSO and Intellexa

Google has identified a connection between Russian state hackers and exploits that bear an “identical or strikingly similar” resemblance to those created by spyware companies NSO Group and Intellexa, ... Read more

Published Date: Aug 29, 2024 (3 months ago)
  • security.nl
WhatsUp Gold-servers actief aangevallen via kritiek path traversal-lek

Een kritieke kwetsbaarheid in WhatsUp Gold, ontwikkeld door softwarebedrijf Progress, maakt het mogelijk om kwetsbare servers over te nemen en aanvallers maken actief misbruik van het beveiligingslek. ... Read more

Published Date: Aug 29, 2024 (3 months ago)
  • The Cyber Express
Iranian State Hackers Act as Access Brokers for Ransomware Gangs, Target U.S. and Allies’ Critical Infrastructure

A shadowy group of Iranian cyber actors is acting as access brokers for ransomware gangs and collaborating with affiliates to target the U.S. and its allies, exploiting vulnerabilities across sectors ... Read more

Published Date: Aug 28, 2024 (3 months ago)
  • The Cyber Express
Critical Apache OFBiz Vulnerability CVE-2024-38856 Identified and Actively Exploited

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has flagged a security vulnerability affecting Apache OFBiz, the open-source enterprise resource planning (ERP) system. This Apache OFB ... Read more

Published Date: Aug 28, 2024 (3 months, 1 week ago)
  • The Cyber Express
Critical WPML Plugin Flaw Exposes Millions of WordPress Sites to Remote Code Execution

A critical vulnerability has been discovered in the WPML (WordPress Multilingual) plugin, exposing millions of WordPress websites to potential Remote Code Execution (RCE) attacks. This WPML Plugin Fla ... Read more

Published Date: Aug 28, 2024 (3 months, 1 week ago)
  • The Cyber Express
Versa Director Zero-Day Attack: A Non-Critical Vulnerability with Low Exposure Can Still Be Trouble

A zero-day vulnerability in Versa Director servers is proof that a vulnerability doesn’t require a critical severity rating and thousands of exposures to do significant damage. CVE-2024-39717, announc ... Read more

Published Date: Aug 27, 2024 (3 months, 1 week ago)
  • The Cyber Express
Critical Chrome Zero-Day Vulnerability (CVE-2024-7965) Requires Immediate User Action

Google recently addressed a critical zero-day vulnerability in its Chrome browser, identified as CVE-2024-7965. This high-severity flaw, affecting versions of Chrome prior to 128.0.6613.84, has been a ... Read more

Published Date: Aug 27, 2024 (3 months, 1 week ago)
  • Cybersecurity News
Critical Vulnerabilities Uncovered in Progress WhatsUp Gold (CVE-2024-6670 & CVE-2024-6671)

The Progress WhatsUp Gold team has recently disclosed multiple critical vulnerabilities affecting all versions of the software released before 2024.0.0. These vulnerabilities, identified as CVE-2024-6 ... Read more

Published Date: Aug 23, 2024 (3 months, 1 week ago)
  • The Cyber Express
Critical Remote Code Execution Vulnerability Addressed in GiveWP Plugin

The GiveWP plugin, a widely used donation and fundraising tool for WordPress, has recently undergone a crucial update to address a severe security flaw. This GiveWP vulnerability, discovered by the re ... Read more

Published Date: Aug 20, 2024 (3 months, 2 weeks ago)
  • The Hacker News
Critical Security Flaw in WhatsUp Gold Under Active Attack - Patch Now

Vulnerability / Network Security A critical security flaw impacting Progress Software WhatsUp Gold is seeing active exploitation attempts, making it essential that users move quickly to apply the late ... Read more

Published Date: Aug 08, 2024 (3 months, 3 weeks ago)
  • BleepingComputer
Critical Progress WhatsUp RCE flaw now under active exploitation

Threat actors are actively attempting to exploit a recently fixed  Progress WhatsUp Gold remote code execution vulnerability on exposed servers for initial access to corporate networks. The vulnerabil ... Read more

Published Date: Aug 07, 2024 (3 months, 3 weeks ago)

The following table lists the changes that have been made to the CVE-2024-4885 vulnerability over time.

Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.

  • CVE Modified by af854a3a-2127-422b-91ae-364da2661108

    Nov. 21, 2024

    Action Type Old Value New Value
    Added Reference https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024
    Added Reference https://www.progress.com/network-monitoring
  • Initial Analysis by [email protected]

    Sep. 06, 2024

    Action Type Old Value New Value
    Added CVSS V3.1 NIST AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    Changed Reference Type https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 No Types Assigned https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 Vendor Advisory
    Changed Reference Type https://www.progress.com/network-monitoring No Types Assigned https://www.progress.com/network-monitoring Product
    Added CWE NIST NVD-CWE-noinfo
    Added CPE Configuration OR *cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:* versions up to (excluding) 23.1.3
  • CVE Received by [email protected]

    Jun. 25, 2024

    Action Type Old Value New Value
    Added Description In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold.  The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.
    Added Reference Progress Software Corporation https://www.progress.com/network-monitoring [No types assigned]
    Added Reference Progress Software Corporation https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 [No types assigned]
    Added CWE Progress Software Corporation CWE-22
    Added CVSS V3.1 Progress Software Corporation AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS is a daily estimate of the probability of exploitation activity being observed over the next 30 days. Following chart shows the EPSS score history of the vulnerability.
CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-4885 is associated with the following CWEs:

CVSS31 - Vulnerability Scoring System
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability