CVE-2024-6670: Progress WhatsUp Gold SQL Injection Exposes Encrypted Passwords

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityCVSS 9.8, unauthenticated network exploitation, confirmed active exploitation with ransomware use, and CISA KEV listing make this an urgent patching priority.

What it is

WhatsUp Gold versions before 2024.0.0 contain a SQL injection flaw (CWE-89) that an unauthenticated attacker can use to retrieve users' encrypted passwords. Because the vulnerable component is network-reachable and requires no credentials, it is a high-value initial access vector for a widely deployed network monitoring product.

Impact

An attacker gains access to encrypted user passwords, which can be cracked offline or reused to move laterally into the monitoring platform and the infrastructure it manages. Successful exploitation can lead to full compromise of the WhatsUp Gold host and connected systems.

Attack surface

Reachable over the network via the WhatsUp Gold web interface; the CVSS vector (AV:N/PR:N/UI:N) confirms no authentication and no user interaction are required.

Exploitation

CISA added this to the Known Exploited Vulnerabilities catalog on 2024-09-16 with known ransomware campaign use, and EPSS gives a 30-day exploitation probability of 0.93 (99.8th percentile), indicating active exploitation in the wild.

What to do

• Upgrade WhatsUp Gold to 2024.0.0 or later immediately; this is the only complete fix.
• If immediate upgrade is not possible, apply the vendor mitigations in the Progress August 2024 security bulletin or discontinue use of the product per CISA guidance.
• Restrict network access to the WhatsUp Gold web interface to trusted management networks and block it from the public internet.
• Rotate all WhatsUp Gold user credentials and any credentials stored or managed by the platform, since encrypted passwords may have been exposed.
• Monitor for and investigate any signs of lateral movement or ransomware activity originating from the WhatsUp Gold host.

Detection

• Review WhatsUp Gold web server and application logs for SQL injection patterns or anomalous database queries, especially from unauthenticated sessions.
• Hunt for unusual outbound connections or data transfers from the WhatsUp Gold host that could indicate password exfiltration.
• Audit authentication logs for successful logins using WhatsUp Gold accounts from unexpected source IPs or at unusual times.
• Check for indicators of compromise associated with known ransomware campaigns that have exploited this CVE.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.