{"id":"CVE-2024-6670","kind":"vulnerability","aliases":["CVE-2024-6670"],"related":[],"title":"progress whatsup gold: In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker…","description":"Progress WhatsUp Gold contains a SQL injection vulnerability that allows an unauthenticated attacker to retrieve the user's encrypted password if the application is configured with only a single user.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Progress WhatsUp Gold, a network monitoring product, has a SQL injection flaw that lets an unauthenticated attacker pull the stored encrypted password of the user when the application has only one user configured. CISA lists it as exploited in the wild and tied to ransomware campaigns.","severity":"critical","cvss":9.8,"epss":null,"exploited":true,"exploited_at":"2024-09-16T00:00:00+00:00","products":[{"name":"progress whatsup gold","fixed":["24.0"],"affected":"< 24.0","ecosystem":"vendor"},{"name":"Progress WhatsUp Gold","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","package","ransomware","self-hosted","whatsup-gold","windows"],"not_affected_if":["default-config"],"how_to_check":"Check the WhatsUp Gold version in the product's About page or install directory against the vendor advisory; the sources do not give a command.","fix":"Apply the vendor mitigations per Progress's instructions, or discontinue use of the product if mitigations are unavailable (per CISA's required action).","status":"open","published_at":"2024-08-29T22:15:05+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:10+00:00","updated_at":"2026-10-24T00:09:51+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-23T20:58:10Z","model":"claude-haiku-5-5","output":{"fix":"Apply the vendor mitigations per Progress's instructions, or discontinue use of the product if mitigations are unavailable (per CISA's required action).\nunknown","reach":"internet","impact":"medium","summary":"Progress WhatsUp Gold, a network monitoring product, has a SQL injection flaw that lets an unauthenticated attacker pull the stored encrypted password of the user when the application has only one user configured. CISA lists it as exploited in the wild and tied to ransomware campaigns.","category":"package","who_cares":["whatsup-gold","self-hosted","windows"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker reads the encrypted password of the single configured user remotely.","analyst_note":"Find the Progress vendor advisory and the affected/fixed version range; the sources only give 'affected ?' and 'fixed ?'. Check CISA KEV for the due date and the ransomware tag source.","how_to_check":"Check the WhatsUp Gold version in the product's About page or install directory against the vendor advisory; the sources do not give a command.\nunknown","needs_analyst":true,"not_affected_if":["default-config"],"user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000503,"input_tokens":2837,"output_tokens":438,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':20A,23A '-6670':21A,24A '2024.0.0':10A 'action':119C 'allow':15A,96C 'appli':120C 'applic':68B,109C 'attack':18A,57B,99C 'campaign':86B 'cisa':74B,117C 'configur':73B,111C 'contain':90C 'cve':19A,22A 'discontinu':126C 'encrypt':61B,105C 'exploit':31B,78B 'flaw':52B 'gold':3A,6A,27A,30A,39B,43B,89C 'host':36B 'inject':13A,51B,93C 'instruct':124C 'let':54B 'list':75B 'mitig':121C,132C 'monitor':46B 'network':45B 'one':71B 'packag':32B 'password':62B,106C 'per':122C 'product':47B,130C 'progress':1A,25A,28A,41B,87C 'pull':58B 'ransomwar':33B,85B 'releas':8A 'requir':118C 'retriev':101C 'self':35B 'self-host':34B 'singl':115C 'sql':12A,50B,92C 'store':60B 'tie':83B 'unauthent':17A,56B,98C 'unavail':134C 'use':127C 'user':65B,72B,103C,116C 'vendor':123C 'version':7A 'vulner':14A,94C 'whatsup':2A,5A,26A,29A,38B,42B,88C 'whatsup-gold':37B 'wild':81B 'window':40B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-08-29T22:15:05+00:00","kev":{"dateAdded":"2024-09-16","dueDate":"2024-10-07","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-6670","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-6670","severity":null,"published_at":"2024-09-16T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-6670","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6670","severity":null,"published_at":"2024-08-29T22:15:05+00:00","modified_at":"2026-06-17T08:18:27+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}