---
title: "WhatsUp Gold CVE-2024-6670: Pre-Auth SQLi to Admin Takeover"
url: https://erroneo.us/security/briefs/whatsup-gold-cve-2024-6670-sql-injection/
description: "Pre-auth SQL injection in WhatsUp Gold before 2024.0.0, exploited hours after a PoC to plant remote-access tools. Move to 2026.0.2 and hunt old servers."
type: security-brief
section: "Security Digest"
date_published: 2024-08-16
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2024-6670"]
severity: "critical"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# WhatsUp Gold CVE-2024-6670: Pre-Auth SQLi to Admin Takeover

**Verdict: Check exposure.** Fixed in August 2024 and exploited the day the exploit went public; make sure no WhatsUp Gold server is still on a 2023 or 2024 build, since 2024.0.0 is far behind later critical fixes, and hunt on any that sat exposed.

- **Who must act:** Owners of WhatsUp Gold servers on any release before 2024.0.0, anyone still on a 2024.x build, and anyone whose WhatsUp Gold web console was reachable from the internet in 2024.
- **Who can relax:** Organizations that do not run WhatsUp Gold, and those already on 2026.0.2 or later with the console reachable only from an admin network.
- **Affected:** WhatsUp Gold 2023.1.0 and later releases before 2024.0.0 (CVE record range)
- **Fixed:** WhatsUp Gold 2024.0.0 (Aug 16, 2024); Now: 2026.0.2 (Aug 12, 2026) or later, which also fixes the unauthenticated RCE CVE-2026-65941
- **CVEs:** CVE-2024-6670
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Record the version of every WhatsUp Gold server.
2. Upgrade to 2026.0.2 or later; 2024.0.0 fixes this bug but not CVE-2024-8785 (fixed in 2024.0.1) or CVE-2026-65941 (fixed in 2026.0.2).
3. Remove internet exposure of the web console and restrict it to an admin network or VPN.
4. If a server ran an unpatched build while reachable in late 2024, reset the admin password and rotate the device credentials WhatsUp Gold uses for monitoring.
5. Until patched, consider disabling the Active Monitor PowerShell Script function, as Trend Micro suggests.

### How to check if you are affected

- Look for powershell.exe or msiexec.exe started by nmpoller.exe under the WhatsUp Gold install path.
- Search hosts for C:\ProgramData\a.ps1, C:\ProgramData\ftpd32.exe and c:\windows\temp\MSsetup.msi, and for unexpected Atera, Radmin, SimpleHelp or Splashtop installs.
- Check proxy and firewall logs for 185.123.100.160 and 45.227.255.216 from Trend Micro's report.
- Search IIS logs for requests to /NmConsole/Platform/PerformanceMonitorErrors/HasErrors from untrusted addresses, and review PowerShell-script active monitors and admin password changes.

## What happened

On August 16, 2024, Progress released WhatsUp Gold 2024.0.0. Its [release notes](https://docs.progress.com/bundle/whatsupgold-release-notes-24-0/page/WhatsUp-Gold-2024.0-Release-Notes.html) list four security fixes, including CVE-2024-6670 and CVE-2024-6671. The [CVE record](https://www.cve.org/CVERecord?id=CVE-2024-6670) says CVE-2024-6670 is a SQL injection (CWE-89) that lets an unauthenticated attacker retrieve a user's encrypted password. CISA's description adds that this applies when the product is set up with a single user. Progress scores it CVSS 3.1 9.8, and [NVD](https://nvd.nist.gov/vuln/detail/CVE-2024-6670) agrees.

The finder, Sina Kheirkhah of Summoning Team, reported it through Trend Micro's Zero Day Initiative. His [write-up](https://summoning.team/blog/progress-whatsup-gold-sqli-cve-2024-6670/) places the injection in `/NmConsole/Platform/PerformanceMonitorErrors/HasErrors`. He paired it with an unauthenticated endpoint that encrypts any value the caller supplies. With the two, the injection overwrites the administrator's password with one the attacker chose. After that, he notes, the product's own features allow code execution.

The proof of concept went public on August 30, 2024, at 5 p.m. UTC. [Trend Micro](https://www.trendmicro.com/en_us/research/24/i/whatsup-gold-rce.html) saw the first attack five hours later. Attackers abused the Active Monitor PowerShell Script feature, so the polling process `NmPoller.exe` ran their scripts. Those scripts installed Atera Agent, Radmin, SimpleHelp and Splashtop. Trend Micro did not name the actor but said the set of tools suggests a possible ransomware crew. CISA added the CVE to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-6670) on September 16, 2024, and marks known ransomware use.

## Who is affected

WhatsUp Gold on Windows, releases before 2024.0.0. Singapore's [CSA](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2024-110/) told users to move to the latest version.

## Do you really need to act?

If you upgraded in 2024 and kept going, no. The verdict is check exposure because 2024.0.0 is not a safe floor. [CVE-2024-8785](https://www.cve.org/CVERecord?id=CVE-2024-8785), an unauthenticated registry-overwrite RCE, needed 2024.0.1. [CVE-2026-65941](https://www.cve.org/CVERecord?id=CVE-2026-65941) is an unauthenticated RCE from the adjacent network, rated 8.8. It was fixed in 2026.0.2 on August 12, 2026, per the [2026.0 notes](https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html). A second WhatsUp Gold bug, [CVE-2024-4885](https://www.cve.org/CVERecord?id=CVE-2024-4885), joined KEV on March 3, 2025, so attackers keep returning to this product. A monitoring server also reaches deep into the network it watches. That makes old compromises worth checking.

## What to do now

1. Check versions, for example with `Get-ItemProperty HKLM:\Software\Microsoft\Windows\CurrentVersion\Uninstall\*, HKLM:\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\* | Where-Object DisplayName -like '*WhatsUp*' | Select DisplayName, DisplayVersion`.
2. Upgrade to 2026.0.2 or later.
3. Keep the web console off the internet.
4. If a server was exposed and unpatched in late 2024, reset the admin password and rotate the device credentials it stores.
5. If you cannot patch yet, Trend Micro suggests disabling the Active Monitor PowerShell Script function.

## How to tell if you were hit

- Trend Micro calls `powershell.exe` or `msiexec.exe` children of `nmpoller.exe` highly suspicious.
- Look for `C:\ProgramData\a.ps1`, `C:\ProgramData\ftpd32.exe`, `c:\windows\temp\MSsetup.msi` and remote-access agents you never approved.
- Check network logs for `185.123.100.160` and `45.227.255.216`.
- Search IIS logs for `HasErrors` requests from untrusted addresses, and review PowerShell-type active monitors.

## Timeline

- Aug 16, 2024 — WhatsUp Gold 2024.0.0 is released.
- Aug 29, 2024 — CVE-2024-6670 is published.
- Aug 30, 2024 — The PoC is published; Trend Micro sees the first attack.
- Sep 16, 2024 — CISA adds CVE-2024-6670 to KEV.
- Sep 20, 2024 — 2024.0.1 fixes CVE-2024-8785.
- Mar 3, 2025 — CISA adds CVE-2024-4885 to KEV.
- Aug 12, 2026 — 2026.0.2 fixes CVE-2026-65941.

## Sources

1. [Progress — WhatsUp Gold 2024.0 Release Notes](https://docs.progress.com/bundle/whatsupgold-release-notes-24-0/page/WhatsUp-Gold-2024.0-Release-Notes.html)
2. [Progress — WhatsUp Gold 2026.0 Release Notes](https://docs.progress.com/bundle/whatsupgold-release-notes-26-0/page/WhatsUp-Gold-2026.0-Release-Notes.html)
3. [CVE record — CVE-2024-6670](https://www.cve.org/CVERecord?id=CVE-2024-6670)
4. [NVD — CVE-2024-6670](https://nvd.nist.gov/vuln/detail/CVE-2024-6670)
5. [CISA — Known Exploited Vulnerabilities: CVE-2024-6670](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-6670)
6. [Summoning Team (Sina Kheirkhah) — Breaking Down Barriers: Exploiting Pre-Auth SQL Injection in WhatsUp Gold](https://summoning.team/blog/progress-whatsup-gold-sqli-cve-2024-6670/)
7. [Trend Micro — WhatsUp Gold remote code execution attacks (Sep 12, 2024)](https://www.trendmicro.com/en_us/research/24/i/whatsup-gold-rce.html)
8. [Cyber Security Agency of Singapore — Critical Vulnerabilities in WhatsUp Gold (AL-2024-110)](https://www.csa.gov.sg/alerts-and-advisories/alerts/al-2024-110/)
9. [CVE record — CVE-2024-4885](https://www.cve.org/CVERecord?id=CVE-2024-4885)
10. [CVE record — CVE-2024-8785](https://www.cve.org/CVERecord?id=CVE-2024-8785)
11. [CVE record — CVE-2026-65941](https://www.cve.org/CVERecord?id=CVE-2026-65941)

---
Source page: https://erroneo.us/security/briefs/whatsup-gold-cve-2024-6670-sql-injection/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt