vulnerability

Progress WhatsUp Gold Vulnerability (CVE-2024-4885): Remote Code Execution

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:C/I:C/A:C)

Published

Jun 25, 2024

Added

Jun 27, 2024

Modified

Mar 4, 2025

Description

In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.

Solution

progress-whatsup-gold-upgrade-latest

References

CVE-2024-4885
https://attackerkb.com/topics/CVE-2024-4885
https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report