Progress WhatsUp Gold Unauthenticated Remote Code Execution (RCE) Vulnerability Advisory (CVE-2024-4885)
Executive & SecOps Summary
SECOPS ASSESSMENTProgress WhatsUp Gold versions prior to 2023.1.3
Impact] Unauthenticated remote attackers can execute arbitrary commands with 'iisapppool\ mconsole' privileges, leading to full system compromise
Immediately upgrade WhatsUp Gold to version 2023.1.3 or later and restrict external access
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Apply the official security patch provided by Progress by upgrading WhatsUp Gold to version 2023.1.3 or later immediately.
2. Temporary Workaround & Hardening Configuration
Until the patch can be applied, restrict access to the WhatsUp Gold web console ports (default TCP 80, 443, 6443) at the firewall level. Implement IIS IP Address and Domain Restrictions to allow access only from trusted administrator IP ranges.
# PowerShell script to restrict IIS access to trusted IP ranges for WhatsUp Gold
Import-Module WebAdministration
$siteName = 'WhatsUpGold'
Set-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name 'allowUnlisted' -Value $false -PSPath 'IIS:\' -Location $siteName
Add-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name '.' -Value @{ipAddress='10.0.0.0';subnetMask='255.255.0.0';allowed=$true} -PSPath 'IIS:\' -Location $siteName3. Log Audit & IoC Verification Commands
Inspect IIS access logs for any requests targeting the vulnerable endpoint with path traversal sequences.
# Search IIS logs for suspicious GetFileWithoutZip requests and path traversal patterns
grep -i 'GetFileWithoutZip' /cygdrive/c/inetpub/logs/LogFiles/W3SVC1/*.log | grep -E '(\.\./|\.\.\\)'Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-4885) is a critical unauthenticated Remote Code Execution (RCE) vulnerability in Progress WhatsUp Gold. The root cause lies in the lack of proper input validation and sanitization within the WhatsUp.ExportUtilities.Export.GetFileWithoutZip method, which allows path traversal (CWE-22) and subsequent arbitrary command execution.
2. Exploitation Mechanics & Attack Scenario
An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the WhatsUp Gold web application server. By targeting the GetFileWithoutZip method and injecting path traversal sequences (e.g., ../) along with system commands into the parameters, the attacker bypasses authentication. The application processes the malicious input, executing the commands under the context of the IIS application pool identity, specifically iisapppool\ mconsole.
3. Infrastructure & Business Impact
WhatsUp Gold is widely used for network monitoring and infrastructure management, holding extensive access to internal network assets. Since this vulnerability is listed in the CISA KEV catalog and has an EPSS score of 0.9929, active exploitation attempts are highly prevalent. Successful exploitation allows attackers to gain an initial foothold, perform lateral movement, steal credentials, or deploy ransomware, posing a severe threat to business continuity.
Official Vendor Advisories & References
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.
Frequently Asked SecOps Questions (CVE-2024-4885)
FAQQ1. How critical is CVE-2024-4885 and is it actively exploited in the wild?
CVE-2024-4885 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 99.3%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-4885?
Primary impacted vendors include progress across whatsup gold. Scope summary: All Progress WhatsUp Gold versions released before 2023.1.3
Q3. What temporary mitigations or workarounds exist for CVE-2024-4885 before patching?
[Mitigation] Immediately upgrade WhatsUp Gold to version 2023.1.3 or later and restrict external access Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-4885
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (progress)
View Category →Progress Kemp LoadMaster API OS Command Injection Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-8037)
[Affected Scope] API management interfaces of Progress Kemp LoadMaster load balancer appliances
Adobe ColdFusion Path Traversal Remote Code Execution Vulnerability Urgent Advisory (CVE-2026-48282)
[Affected Scope] Adobe ColdFusion versions 2025.9, 2023.20 and earlier
WebDyne Perl Framework Path Traversal and Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-78189)
[Affected Scope] Perl web applications utilizing WebDyne versions 3.007 through 3.021
Ahsay AhsayCBS Replication Receiver Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-105134)
[Affected Scope] AhsayCBS versions up to 9.15.2.69 and 10.3.4.44, specifically the Replication Receiver component
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.