CVE-2024-4885: Progress WhatsUp Gold Path Traversal Vulnerability
Vulnerability summary
CVE-2024-4885 is a critical (CVSS 9.8) Path Traversal vulnerability in Progress WhatsUp Gold. It is known to be exploited: CISA lists it, first on 03-03-2025. EPSS estimates a 99.29% chance of exploitation in the next 30 days, higher than 99.9% of scored vulnerabilities.
Timeline
- 25-06-2024PublishedVulnerability first disclosed.
- 03-03-2025Added to CISA KEVProgress WhatsUp Gold Path Traversal Vulnerability
- 24-03-2025CISA remediation dueApply mitigations per vendor instructions.
- 21-10-2025Last modifiedVulnerability information updated.
Description
In WhatsUp Gold versions released before 2023.1.3, an unauthenticated Remote Code Execution vulnerability in Progress WhatsUpGold. The WhatsUp.ExportUtilities.Export.GetFileWithoutZip allows execution of commands with iisapppool\nmconsole privileges.
CVSS metrics
2 scores · 2 sources · 1 version- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
99.29%
Chance of exploitation in the next 30 days
Percentile
100%
Versus all other CVEs
30-day change
0.00 pp
From 99.29% on 20-09-2026
Known exploited
Compare KEV catalogs
CISA KEVListed- Added
- 03-03-2025
- Federal due date
- 24-03-2025
CISA required action
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024 nvd.nist.gov/vuln/detail/CVE-2024-4885
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Progress1 product
- whatsup_gold< 23.1.3
Progress software corporation1 product
- whatsup gold≥ 2023.1.0, < 2023.1.3
2 vendors · 2 products
References
3 links- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-4885Government ResourceUS Government Resource