Critical Vulnerability Discovered in Progress WhatsUp Gold

What changed

A serious path traversal vulnerability has been uncovered in Progress WhatsUp Gold, specifically affecting versions prior to 2023.1.3. This flaw enables unauthenticated remote code execution, posing a substantial risk to users.

The vulnerability arises from the WhatsUp.ExportUtilities.Export.GetFileWithoutZip function, which permits the execution of commands under the iisapppool\nmconsole privileges.

Who is affected

Organizations utilizing Progress WhatsUp Gold are at risk, particularly those running versions released before 2023.1.3. The implications of this vulnerability could be severe, impacting various sectors.

Affected groups include IT departments, network administrators, and service providers relying on WhatsUp Gold for network monitoring.

• Progress WhatsUp Gold users on outdated versions
• Network administrators managing monitoring solutions
• IT departments in organizations relying on WhatsUp Gold
• Service providers offering network management services

What to do

It is crucial for affected users to upgrade to the latest version of Progress WhatsUp Gold to mitigate this vulnerability. Regular updates and patches should be a priority to ensure system security.

Additionally, organizations should review their security policies and practices to prevent similar vulnerabilities from being exploited in the future.

• Upgrade to Progress WhatsUp Gold version 2023.1.3 or later
• Implement regular security updates and patches
• Review and enhance security policies and practices
• Conduct vulnerability assessments to identify potential risks