CVE-2024-4885
Progress WhatsUp Gold Path Traversal Vulnerability
Description
CVE-2024-4885 is a critical unauthenticated remote code execution vulnerability in Progress WhatsUp Gold, a widely used network monitoring solution. The vulnerability resides in the WhatsUp.ExportUtilities.Export.GetFileWithoutZip endpoint, which allows unauthenticated attackers to execute arbitrary commands with iisapppool\nmconsole privileges on the affected server. With a CVSS v3.1 base score of 9.8 and an EPSS score of 94.26% at the 99.9th percentile, this is among the most likely-to-be-exploited vulnerabilities currently tracked. CISA has added CVE-2024-4885 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 24, 2025.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| progress | whatsup gold | < 23.1.3 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
Weakness Type
Remote Code Execution via Insecure Export Utility
CVE-2024-4885 involves a remote code execution flaw in the export utility component of WhatsUp Gold. The vulnerability allows unauthenticated attackers to invoke server-side functionality that executes operating system commands. The underlying weakness relates to insufficient access control on a critical function combined with improper input validation, enabling command injection through the GetFileWithoutZip method. This class of vulnerability falls under CWE-94 (Improper Control of Generation of Code) and CWE-306 (Missing Authentication for Critical Function), as the exploitable endpoint lacks authentication requirements and processes attacker-controlled input as executable commands.
Learn more: CWE-94 — Improper Control of Generation of Code
Impact Analysis
CVE-2024-4885 poses an extreme risk to any organization running affected versions of WhatsUp Gold. The vulnerability is network-exploitable (AV:N) with low attack complexity (AC:L), requiring no authentication (PR:N) and no user interaction (UI:N), making it trivially exploitable from the internet if the WhatsUp Gold interface is exposed. Confidentiality (High): Remote code execution with iisapppool\nmconsole privileges grants access to the server's file system, network configuration, stored credentials, and all data monitored by WhatsUp Gold — which typically includes SNMP credentials, network device configurations, and infrastructure topology information. Integrity (High): The attacker can modify server files, alter monitoring configurations to hide malicious activity, install backdoors, and pivot to other network devices using credentials stored in WhatsUp Gold. Availability (High): Full command execution allows the attacker to shut down services, destroy data, deploy ransomware, or use the monitoring server as a launch point for denial-of-service attacks against monitored infrastructure. With an EPSS score of 94.26% at the 99.9th percentile, exploitation is virtually certain for exposed instances. Network monitoring tools are high-value targets because they store credentials for managed devices across the entire infrastructure.
Exploit Maturity
CVE-2024-4885 exhibits maximum exploit maturity with near-certain exploitation probability. CISA has added this vulnerability to the Known Exploited Vulnerabilities catalog, mandating remediation by March 24, 2025. The EPSS score of 94.26% at the 99.9th percentile places this among the top 0.1% most likely-to-be-exploited vulnerabilities globally. Progress Software has published a security bulletin detailing the vulnerability and remediation. The unauthenticated nature of the exploit, combined with the high value of network monitoring infrastructure as an attack target, makes this vulnerability extremely attractive to both opportunistic and targeted threat actors. While the ransomware association is currently listed as unknown, the ability to execute commands as the IIS application pool identity provides a direct path to system compromise.
Remediation
-
Upgrade WhatsUp Gold to version 2023.1.3 or later immediately. Progress Software has fixed CVE-2024-4885 in WhatsUp Gold version 2023.1.3. All versions before 2023.1.3 are vulnerable. Download the update from the Progress WhatsUp Gold product page and follow the upgrade procedures.
-
Restrict network access to WhatsUp Gold interfaces. If immediate patching is not possible, restrict access to the WhatsUp Gold web interface to trusted management networks only. Block external access through firewall rules and ensure the interface is not exposed to the internet.
-
Rotate all stored credentials. WhatsUp Gold stores SNMP community strings, WMI credentials, SSH keys, and other authentication materials for monitored devices. After patching, assume these credentials may have been compromised and rotate them across all monitored devices and systems.
-
Conduct forensic investigation on WhatsUp Gold servers. Review IIS logs, Windows event logs, and process execution logs for indicators of exploitation. Look for suspicious processes spawned by the IIS application pool, unusual network connections, and unauthorized file modifications. Check for persistence mechanisms such as scheduled tasks, new user accounts, or web shells.
-
Implement application-level monitoring. Deploy web application firewall (WAF) rules to detect and block exploitation attempts targeting the GetFileWithoutZip endpoint. Enable detailed logging for the WhatsUp Gold web application and configure alerts for anomalous API calls to export-related functionality.
Technical Details
CVE-2024-4885 is an unauthenticated remote code execution vulnerability in Progress WhatsUp Gold versions prior to 2023.1.3. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H reflects the maximum exploitability — network-accessible, low complexity, no authentication, no user interaction — with maximum impact across confidentiality, integrity, and availability. The vulnerability exists in the WhatsUp.ExportUtilities.Export.GetFileWithoutZip method, which is part of the application's data export functionality. This endpoint is accessible without authentication, and the method processes user-supplied input in a way that allows command injection. When an attacker sends a crafted request to this endpoint, the application executes the attacker's commands in the context of the IIS application pool identity (iisapppool\nmconsole). This service account typically has significant privileges on the server, including access to the WhatsUp Gold database, configuration files containing device credentials, and the ability to interact with the Windows operating system. The attack requires only a single HTTP request to the vulnerable endpoint, making exploitation trivial and reliable. The unchanged scope (S:U) indicates that while the impact is limited to the WhatsUp Gold server's security context, the stored credentials and network access make the practical impact extend far beyond the compromised server.
Frequently Asked Questions
Is CVE-2024-4885 being actively exploited?
Yes. CISA has confirmed active exploitation by adding CVE-2024-4885 to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 24, 2025. The EPSS score of 94.26% at the 99.9th percentile indicates near-certain exploitation activity, making it one of the most actively targeted vulnerabilities.
What versions of WhatsUp Gold are affected?
All versions of Progress WhatsUp Gold released before version 2023.1.3 are affected by CVE-2024-4885. Organizations should upgrade to version 2023.1.3 or later to remediate the vulnerability.
Does CVE-2024-4885 require authentication to exploit?
No. CVE-2024-4885 is an unauthenticated remote code execution vulnerability. An attacker needs only network access to the WhatsUp Gold web interface to exploit the GetFileWithoutZip endpoint and execute arbitrary commands without providing any credentials.
How severe is CVE-2024-4885?
CVE-2024-4885 is rated Critical with a CVSS v3.1 base score of 9.8 out of 10. The vulnerability allows unauthenticated remote code execution, and network monitoring tools like WhatsUp Gold typically store credentials for all monitored devices, making a compromise potentially devastating to the entire network infrastructure.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.