[HIGH PRIORITY] Progress WhatsUp Gold RCE (CVE-2024-6670)

⚠ HIGH PRIORITY — CISA KEV. CVE-2024-6670 is an unauthenticated remote code execution flaw in Progress WhatsUp Gold network monitoring. Attackers run commands on Windows or Linux monitoring servers with network visibility into your entire infrastructure.

Affected WhatsUp Gold

• WhatsUp Gold before 2024.0.1
• Monitoring servers on ports 9643/443
• MSP NOC dashboards exposed to internet

Detect exposure

nmap -p 9643,443 --script http-title monitor-subnet/24
curl -sk https://monitor.example:9643/ | grep -i whatsUp

Patching Method

1. Download WhatsUp Gold 2024.0.1+ from Progress support.
2. Stop WhatsUp Gold services on Linux: systemctl stop whatsuptime (service name varies by install).
3. Run vendor upgrade installer or apply hotfix package.
4. Restart services; confirm version in web admin About page.
5. Rotate SNMP/SSH/API credentials stored in WhatsUp Gold credential library.
6. Review alert history for unauthorized script execution indicators.

# Linux — verify service after patch
systemctl status whatsuptime 2>/dev/null || ps aux | grep -i whatsUp
ss -tlnp | grep 9643

Hardening

• Never expose WhatsUp Gold to public internet
• Segment monitoring server from production VLANs
• Use read-only SNMP community strings where possible