erroneo.us
Search all guides⌘K

Digest · Friday

Security digest: August 16, 2024

1 editorial brief.

All digests · RSS · Markdown

Take stock

  • Check exposure: WhatsUp Gold CVE-2024-6670: Pre-Auth SQLi to Admin Takeover. Owners of WhatsUp Gold servers on any release before 2024.0.0, anyone still on a 2024.x build, and anyone whose WhatsUp Gold web console was reachable from the internet in 2024.
  • None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Editorial briefs

Check exposure

· Vulnerability · CVE-2024-6670

WhatsUp Gold CVE-2024-6670: Pre-Auth SQLi to Admin Takeover

Fixed in August 2024 and exploited the day the exploit went public; make sure no WhatsUp Gold server is still on a 2023 or 2024 build, since 2024.0.0 is far behind later critical fixes, and hunt on any that sat exposed.

Must act: Owners of WhatsUp Gold servers on any release before 2024.0.0, anyone still on a 2024.x build, and anyone whose WhatsUp Gold web console was reachable from the internet in 2024.

Can relax: Organizations that do not run WhatsUp Gold, and those already on 2026.0.2 or later with the console reachable only from an admin network.

  1. Record the version of every WhatsUp Gold server.
  2. Upgrade to 2026.0.2 or later; 2024.0.0 fixes this bug but not CVE-2024-8785 (fixed in 2024.0.1) or CVE-2026-65941 (fixed in 2026.0.2).
  3. Remove internet exposure of the web console and restrict it to an admin network or VPN.

Read the brief →

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 0

GitHub-reviewed advisories rated critical, published this day (Pacific time).

None.