Progress Software program warned clients to patch a number of vital and high-severity vulnerabilities in its WhatsUp Gold community monitoring device as quickly as potential.
Nonetheless, despite the fact that it launched WhatsUp Gold 24.0.1, which addressed the problems final Friday and printed an advisory on Tuesday, the corporate has but to supply any particulars relating to these flaws.
“The WhatsUp Gold team has identified six vulnerabilities that exist in versions below 24.0.1,” Progress warned clients this week.
“We are reaching out to all WhatsUp Gold customers to upgrade their environment as soon as possible to version 24.0.1, released on Friday, September 20. If you are running a version older than 24.0.1 and you do not upgrade, your environment will remain vulnerable.”
The one info out there is that the six vulnerabilities have been reported by Summoning Staff’s Sina Kheirkhah, Pattern Micro’s Andy Niu, and Tenable researchers and have been assigned the next CVE IDs and CVSS base scores:
To improve to the most recent model, obtain the WhatsUp Gold 24.0.1 installer from right here, run it on weak WhatsUp Gold servers, and observe the prompts.
BleepingComputer contacted Progress to request extra particulars about these flaws, however a response was not instantly out there.
Since August 30, attackers have been exploiting two WhatsUp Gold SQL injection vulnerabilities tracked as CVE-2024-6670 and CVE-2024-6671. Each flaws have been patched on August 16 after being reported to Progress by safety researcher Sina Kheirkhah via the Zero Day Initiative (ZDI) on Could 22.
Kheirkhah launched proof-of-concept (PoC) exploit code for the vulnerabilities two weeks after they have been mounted on August 30 (cybersecurity agency Pattern Micro believes the attackers have used his PoC exploit to bypass authentication and obtain distant code execution).
In early August, menace monitoring group Shadowserver Basis additionally noticed makes an attempt to take advantage of CVE-2024-4885, a vital distant code execution WhatsUp Gold vulnerability disclosed on June 25. Kheirkhah additionally found CVE-2024-4885 and printed full particulars on his weblog two weeks later.
