Critical SQL Injection in Progress WhatsUp Gold (CVE‑2024‑6670) Enables Password Extraction
What It Is — Progress WhatsUp Gold contains an unauthenticated SQL‑injection flaw that can be leveraged to read the stored, encrypted password when the application is deployed with a single‑user configuration.
Exploitability — No public exploit kit has been released, but a proof‑of‑concept exists and the vulnerability scores 7.5 (CVSS v3.1 – High), indicating a realistic path to credential disclosure.
Affected Products — All versions of Progress WhatsUp Gold prior to the vendor‑issued patch (see CISA KEV advisory).
Why It Matters for Trust & Control Assurance
- Input‑validation controls must be continuously monitored; a missing validation check directly undermines the integrity of credential‑management evidence.
- Demonstrating secure configuration (e.g., enforcing multi‑user deployments) provides audit‑ready proof that access‑control policies are enforced.
- The flaw highlights the need for defensible evidence that application‑level security controls are tested and remediated, a prerequisite for enterprise buyers demanding a verifiable trust posture.
Recommended Actions
- Deploy the vendor patch for CVE‑2024‑6670 immediately.
- Re‑configure WhatsUp Gold to require multiple user accounts; disable single‑user mode.
- Conduct a targeted input‑validation test (e.g., automated SQL‑i scanning) on all monitoring appliances.
- Update your control‑mapping repository to reflect remediation and capture evidence for audit reviews.
Source: CISA KEV – CVE‑2024‑6670