Progress WhatsUp Gold Unauthenticated SQL Injection Vulnerability (CVE-2024-6670) Security Advisory
Executive & SecOps Summary
SECOPS ASSESSMENTProgress WhatsUp Gold versions released before 2024.0.0
An unauthenticated remote attacker can execute arbitrary SQL queries to retrieve sensitive database information, including encrypted user password hashes
Immediately upgrade WhatsUp Gold to version 2024.0.0 or later and restrict database and web console access
Affected Products & Version Scope
Remediation & Live Workaround Commands
PATCH & WORKAROUND1. Official Patch & Version Upgrade Commands
Progress has released official security patches to address this vulnerability. Administrators must upgrade to WhatsUp Gold version 2024.0.0 or later immediately. Use the following PowerShell command to verify your current installation version:
# Verify the installed version of WhatsUp Gold
$WugPath = 'C:\Program Files (x86)\Ipswitch\WhatsUp'
if (Test-Path "$WugPath\WhatsUp.dll") {
$Version = (Get-Item "$WugPath\WhatsUp.dll").VersionInfo.ProductVersion
Write-Host "Current WhatsUp Gold Version: $Version"
} else {
Write-Host 'WhatsUp Gold installation path not found.' -ForegroundColor Red
}2. Temporary Workaround & Hardening Configuration
If immediate patching is not feasible, restrict access to the WhatsUp Gold web interface (default ports TCP 80, 443) using network firewalls or IIS IP Address and Domain Restrictions to allow only trusted administrative subnets.
# Restrict IIS access to a specific trusted management subnet (e.g., 10.0.0.0/8)
Import-Module WebAdministration
Set-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name 'allowUnlisted' -Value $false -PSPath 'IIS:\'
Add-WebConfigurationProperty -Filter '/system.webServer/security/ipSecurity' -Name '.' -Value @{ipAddress='10.0.0.0';subnetMask='255.0.0.0';allowed='true'} -PSPath 'IIS:\'3. Log Audit & IoC Verification Commands
Search IIS access logs for potential SQL injection patterns and unauthorized access attempts targeting the WhatsUp Gold web application.
# Scan IIS logs for common SQL injection attack patterns
$LogDirectory = 'C:\inetpub\logs\LogFiles\W3SVC1\*'
$Patterns = @('UNION%20SELECT', 'SELECT%20', 'sysdatabases', 'xp_cmdshell', '--')
Get-ChildItem -Path $LogDirectory -Filter *.log | ForEach-Object {
$LogFile = $_.FullName
Select-String -Path $LogFile -Pattern $Patterns | Select-Object Path, LineNumber, Line -First 30
}Block Exploits Instantly with Managed Virtual Patching Rules
Can't patch production immediately? Deploy managed WAF rules at the edge to intercept RCE, SQLi, and deserialization payloads before they hit your origin server.
Technical Root Cause & Exploitation Mechanics
1. Vulnerability Overview & Root Cause
This vulnerability (CVE-2024-6670) is a critical SQL Injection flaw in Progress WhatsUp Gold. It stems from insufficient input validation and a lack of parameterized queries within specific unauthenticated web endpoints. An attacker can exploit this by sending crafted input to the application, which is then directly concatenated into SQL queries executed by the backend database engine.
2. Exploitation Mechanics & Attack Scenario
An unauthenticated attacker targets the exposed WhatsUp Gold web interface by sending malicious HTTP requests containing SQL payloads. Because the application fails to sanitize these inputs, the database executes the injected commands. This allows the attacker to bypass authentication mechanisms and directly query sensitive tables, specifically targeting and retrieving encrypted password hashes of registered users, including administrators. These hashes can subsequently be cracked offline or used in credential-stuffing attacks.
3. Infrastructure & Business Impact
WhatsUp Gold is widely deployed to monitor critical network infrastructure, servers, and applications. Compromising this platform grants attackers deep visibility into the internal network topology and system credentials. This vulnerability is highly critical (CVSS 9.8) and is actively exploited in the wild (listed in CISA KEV), serving as a primary entry point for lateral movement, domain compromise, and ransomware deployment within enterprise environments.
Official Vendor Advisories & References
In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.
Frequently Asked SecOps Questions (CVE-2024-6670)
FAQQ1. How critical is CVE-2024-6670 and is it actively exploited in the wild?
CVE-2024-6670 is rated CVSS 9.8 (CRITICAL) with a 30-day EPSS exploitation probability of 92.9%. It is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, requiring immediate emergency remediation.
Q2. Which vendors and products are affected by CVE-2024-6670?
Primary impacted vendors include progress across whatsup gold. Scope summary: All Progress WhatsUp Gold versions prior to 2024.0.0
Q3. What temporary mitigations or workarounds exist for CVE-2024-6670 before patching?
[Mitigation] Immediately upgrade WhatsUp Gold to version 2024.0.0 or later and restrict database and web console access Follow the CLI remediation commands and interactive SecOps checklist on this page to restrict exposure prior to your maintenance window.
Generate an Internal Engineering Notice or CISO Report for CVE-2024-6670
Instantly format this advisory into an executive CISO summary or engineering patch ticket.
🔗 Related Advisories in Similar Stack (progress)
View Category →LiteLLM Proxy Server SQL Injection Vulnerability (CVE-2026-42208) Security Advisory
[Affected Scope] LiteLLM proxy server environments running versions from 1.81.16 to before 1.83.7
Progress Kemp LoadMaster API OS Command Injection Remote Code Execution (RCE) Vulnerability Advisory (CVE-2026-8037)
[Affected Scope] API management interfaces of Progress Kemp LoadMaster load balancer appliances
Metabase /reset_password Endpoint Unauthenticated SQL Injection and Admin Takeover (CVE-2026-72898)
[Affected Scope] Unpatched active instances of Metabase Open Source and Enterprise editions
Drupal Core SQL Injection Vulnerability (CVE-2026-9082) Critical Security Advisory
[Affected Scope] Drupal core versions 8.9.0 to < 10.4.10, 10.5.0 to < 10.5.10, 10.6.0 to < 10.6.9, 11.0.0 to < 11.1.10, 11.2.0 to < 11.2.12, and 11.3.0 to < 11.3.10
Subscribe to Daily Vulnerability Briefings & KEV Alerts
Concise morning briefings for SecOps, DevSecOps, and SRE teams covering newly exploited CVEs and mitigation priorities.