{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3aprogresswhatsup_gold/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*"],"_cs_cves":[{"cvss":9.8,"id":"CVE-2024-4883"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["WhatsUp Gold (\u003c 23.1.3)"],"_cs_severities":["critical"],"_cs_tags":["remote-code-execution","webshell","vulnerability"],"_cs_type":"advisory","_cs_vendors":["Progress"],"content_html":"\u003cp\u003eCVE-2024-4883 is a critical vulnerability in Progress WhatsUp Gold that enables unauthenticated remote code execution. The flaw exists within the ICoreServices component's WriteDataFile service, which contains a write-what-where primitive. Exploitation allows an unauthenticated attacker to plant arbitrary files, such as ASPX webshells, into the application's web directory, leading to full system compromise. The vulnerability affects all versions of WhatsUp Gold prior to 23.1.3. A functional proof-of-concept exploit is publicly available.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe attacker establishes a network connection to the ICoreServices service on the target's net.tcp port (typically 9643).\u003c/li\u003e\n\u003cli\u003eThe attacker interacts with the WriteDataFile service.\u003c/li\u003e\n\u003cli\u003eThe attacker leverages the write-what-where primitive to overwrite or create a file in a chosen destination.\u003c/li\u003e\n\u003cli\u003eThe attacker targets the web directory of the WhatsUp Gold installation (e.g., C:\\Program Files (x86)\\Ipswitch\\WhatsUp\\html\\NmConsole).\u003c/li\u003e\n\u003cli\u003eThe attacker plants a malicious ASPX webshell via the primitive.\u003c/li\u003e\n\u003cli\u003eThe attacker navigates to the uploaded webshell via a web browser to achieve remote code execution on the underlying server.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation grants an unauthenticated attacker full system control, including the ability to execute arbitrary code, modify or exfiltrate data, and maintain persistent access to the server. The vulnerability carries a CVSS 3.1 base score of 9.8.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003ePatch immediately by upgrading all Progress WhatsUp Gold instances to version 23.1.3 or later.\u003c/li\u003e\n\u003cli\u003eReview the official Progress security bulletin for additional guidance: \u003ca href=\"https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024\"\u003ehttps://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024\u003c/a\u003e.\u003c/li\u003e\n\u003cli\u003eAudit the 'html\\NmConsole' directory and its subdirectories for any unexpected .aspx files.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T12:27:00Z","date_published":"2026-10-29T12:27:00Z","id":"https://feed.craftedsignal.io/briefs/2026-10-progress-whatsup-gold-rce/","summary":"Progress WhatsUp Gold is vulnerable to unauthenticated remote code execution via a write-what-where primitive in the WriteDataFile service, allowing attackers to plant webshells on the target system.","title":"Progress WhatsUp Gold: Unauthenticated Remote Code Execution (CVE-2024-4883)","url":"https://feed.craftedsignal.io/briefs/2026-10-progress-whatsup-gold-rce/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}