CVE-2024-6670: Progress WhatsUp Gold SQL injection, unauthenticated credential theft
The short version: Progress WhatsUp Gold has a SQL-injection flaw (CVE-2024-6670) that lets an unauthenticated attacker retrieve a stored user's encrypted password straight from the database — a direct path toward account takeover. It's in CISA's KEV catalog, ransomware-associated, and fixed. If you run WhatsUp Gold, patch and verify. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| EPSS | ~94.7% · 99.8th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediation was due 2024-10-07 |
| Known exploited? | Yes — KEV-listed and ransomware-associated |
| Vulnerability type | CWE-89 SQL injection → unauthenticated disclosure of a stored credential |
| Requires authenticated session? | No — pre-authentication |
| Affected | WhatsUp Gold released before 2024.0.0 |
| Fixed in | 2024.0.0 (and later) |
What you need to know
CVE-2024-6670 is a SQL injection in Progress WhatsUp Gold. An unauthenticated attacker submits a crafted request that manipulates a database query and retrieves a stored user's encrypted password — a foothold toward authenticated access on a platform that reaches broadly across the network.
Why this belongs at the top of the queue:
- It's pre-authentication. No account needed — the injection returns credential material directly.
- It's the monitoring platform. WhatsUp Gold polls across an environment; account access there is a strong pivot point.
- It's actively exploited. KEV-listed and ransomware-associated, with a very high EPSS — an exposed, unpatched instance is a live target.
How serious we see it
High — the 9.8 is earned here.
Unauthenticated theft of stored credentials from an internet-facing monitoring server, KEV-listed and ransomware-associated, is top-of-queue. We rate it by what it does and how it's used. The bounded, reassuring part is that it's specific and fixed: WhatsUp Gold before 2024.0.0, with a published patch and quick-to-confirm exposure.
Recommendations
Straight from Progress's advisory and CISA:
- Patch now. Upgrade WhatsUp Gold to 2024.0.0 or later.
- Rotate credentials. Assume disclosed passwords are compromised if the instance was exposed and unpatched — reset them and any reused secrets.
- Restrict exposure. Keep WhatsUp Gold off the open internet; limit it to trusted networks or a VPN.
- Hunt and respond. Review for anomalous logins and signs of compromise; rebuild where warranted.
- Confirm your exposure first. Verify whether you run WhatsUp Gold and which build.
How BreachRisk sees it
BreachRisk discovers internet-facing WhatsUp Gold portals from the outside, fingerprints the product and version, and flags exposure tied to this KEV-listed, actively exploited CVE so it rises to the top of your results. Where safe verification is possible, it issues a bounded, non-destructive request that checks for the injection behavior without extracting or harming data — confirming the exposure rather than assuming it from a version string. That's the difference between "this looks like a vulnerable build" and "we confirmed the flaw responds."