CVE-2024-6670: Progress WhatsUp Gold SQL Injection Vulnerability

CVE-2024-6670 is a SQL injection vulnerability in Progress WhatsUp Gold. It allows an unauthenticated attacker to retrieve a user's encrypted password when the application is configured with only a single user. Because WhatsUp Gold is commonly used for network monitoring and management, successful exploitation can give attackers credentials that unlock further access to infrastructure. Public reporting also links this vulnerability to ransomware activity, elevating the urgency for teams that run the product.

Defenders should treat any internet-facing or poorly segmented WhatsUp Gold instance as high priority until they confirm they are not vulnerable and have applied the vendor-recommended fixes. Specifics such as exact affected builds must be verified against the Progress advisory.

How it works

The flaw is classified as CWE-89 (SQL Injection). In this class of weakness, user-controlled input reaches a database query without proper sanitization or parameterization. An unauthenticated attacker can craft requests that alter the intended SQL logic. According to the CISA summary, when WhatsUp Gold is set up with only a single user account, the injection can be used to retrieve that user's encrypted password. The attacker does not need prior credentials; the only precondition stated is the single-user configuration.

Once the encrypted password is obtained, the attacker may attempt offline cracking or reuse the material in other attacks against the same environment. No further exploit mechanics are provided in the available facts, so teams should not assume particular payloads or endpoints; those details belong in the vendor advisory and any accompanying technical analysis.

Am I affected? How to find it in your systems

WhatsUp Gold is typically deployed as an on-premises network monitoring and management platform, often running on Windows servers and listening on web ports for its console and APIs. Inventory steps include:

• Search asset management, CMDB, or vulnerability scanners for hosts or services labeled “WhatsUp Gold,” “Ipswitch,” or “Progress WhatsUp.”
• Identify web servers or application pools that host the WhatsUp Gold console; note any instances reachable from untrusted networks.
• Check the product’s own “About” or administration pages for the installed version, then compare it against the versions listed as fixed in the Progress advisory for CVE-2024-6670.
• Determine whether the installation is configured with a single user account, because that condition is required for the password-retrieval impact described by CISA.

Log and telemetry signs of exploitation are not detailed in the public facts. In general for SQL-injection attempts, look for anomalous query strings, unexpected database errors, or spikes in failed authentication or data-access events originating from the WhatsUp Gold application account. Correlate web-server access logs with database audit logs if available. Confirm any indicators against the vendor advisory and CISA guidance rather than relying on generic signatures alone.

How to remediate

Patch first. Apply the vendor update that addresses CVE-2024-6670 exactly as described in the Progress advisory. CISA’s required action is to apply mitigations per vendor instructions or to discontinue use of the product if mitigations are unavailable. After patching:

• Verify the new version is running and that the single-user configuration risk has been eliminated or mitigated according to vendor guidance.
• Rotate any credentials that may have been exposed, including the WhatsUp Gold user password and any service accounts the product uses to query network devices or databases.
• Harden the remaining installation: enforce multi-user accounts with least privilege, ensure the application is not internet-facing without strong authentication and network controls, and keep the underlying OS and database fully patched.

Document the change and re-scan to confirm the vulnerability is no longer present.

If you can't patch immediately

Until the official update can be applied, reduce exposure with compensating controls:

• Segment the WhatsUp Gold host so that only trusted management networks can reach its web interface and database ports; block all unsolicited inbound traffic from the internet or untrusted zones.
• If a web application firewall is available, enable virtual-patching rules that detect and block common SQL-injection patterns targeting the product’s known endpoints (confirm rule coverage against the vendor advisory).
• Temporarily disable or restrict any non-essential features that accept unauthenticated input, if the product configuration allows it.
• Increase monitoring: alert on anomalous SQL errors, unexpected data exports, or authentication events involving the WhatsUp Gold service account. Retain logs for forensic review.
• If the risk remains unacceptable and no mitigations are feasible, follow CISA’s guidance and discontinue use of the product until a secure version can be deployed.

If your data may have been exposed

Actively exploited vulnerabilities, especially those with known ransomware use, frequently lead to credential theft and subsequent breaches. If you operated a vulnerable WhatsUp Gold instance that was reachable by untrusted parties, assume the single-user encrypted password may have been retrieved and treat related accounts as compromised. Rotate passwords, review privileged access, and hunt for lateral movement. As a quick personal check, you can run a free exposure scan of your email address against known breach data sets to see whether associated credentials have already appeared in public dumps.