Live › vulnerability › CVE-2024-6670
Go to dashboardProgress WhatsUp Gold, a network monitoring product, has a SQL injection flaw that lets an unauthenticated attacker pull the stored encrypted password of the user when the application has only one user configured. CISA lists it as exploited in the wild and tied to ransomware campaigns.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 19:11 UTC, 3h before NVD. All times on this page are UTC.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| progress whatsup gold | vendor | < 24.0 | 24.0 |
| Progress WhatsUp Gold | vendor | – | – |
Check the WhatsUp Gold version in the product's About page or install directory against the vendor advisory; the sources do not give a command.
Apply the vendor mitigations per Progress's instructions, or discontinue use of the product if mitigations are unavailable (per CISA's required action).
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.
CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
This page as .md · .json · in your agent: get_signal("CVE-2024-6670")
CISA KEV catalog, Creative Commons 0 · NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.