External risk intelligence

WhatsUp Gold Public API Vulnerability Allows Server Access.

CVE advisorySeverity: CRITICAL (CVSS 9.6)

CVE-2024-12108

WhatsUp Gold is a network monitoring platform that frequently operates as an edge service or central management portal. Because the vulnerability exists within the product's public API, which is often exposed to facilitate external monitoring or integration in many common deployment patterns, it presents a likely surface for network-based interaction.

Progress Whatsup Gold

23.1.0 to before 24.0.2

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a critical vulnerability identified in WhatsUp Gold, a network monitoring technology, that could allow unauthorized access to the server through its public API. The primary concern is to confirm if your organization utilizes this specific software and to assess any potential exposure.

Unsecured access to servers via public API.
Critical vulnerability in network monitoring software.
Confirm relevance and assess potential exposure.

Attack Path

How an attacker could exploit the issue

An attacker could leverage the public API of WhatsUp Gold to access the server. Once they have this access, the vulnerability allows them to interact with the system in a way that could lead to significant compromise.

Requires public API exposure.
Triggered via the public API.
Leads to server access.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an attacker with limited access to compromise the WhatsUp Gold server when its public API is exposed. Such a compromise could lead to unauthorized access and modification of system data and potentially impact service availability.

Server data and system configuration.
Via the public API when exposed.
Unauthorized access and data modification.

Operational Fix

Recommended remediation, mitigation, and detection steps

Real-World Ownership: Application owners and infrastructure teams are likely responsible for addressing this critical vulnerability in WhatsUp Gold. The first practical step involves identifying all instances of the affected software, confirming their accessibility and business criticality, and then locating the accountable owner to prioritize and plan remediation.

Application owners should prioritize this issue.
Verify public API exposure and network reachability.
Plan remediation or temporary risk reduction.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is WhatsUp Gold and why is it used?

WhatsUp Gold is a network monitoring platform developed by Progress. IT teams use it to track the health, performance, and availability of network devices, servers, and applications across an entire infrastructure. It acts as a centralized dashboard that provides visibility into system status, often serving as a critical management hub for monitoring traffic and alerts.

How should I interpret the CVE-2024-12108 vulnerability?

CVE-2024-12108 is identified as a CWE-290 weakness, which relates to authentication bypass or spoofing issues. In plain terms, this means the software fails to properly verify the identity of a requestor. Because this flaw exists within the public API of WhatsUp Gold, it allows an unauthorized party to interact with the server by circumventing standard access controls, potentially gaining the same capabilities as a legitimate user.

Does any activity trigger this WhatsUp Gold security flaw?

The vulnerability is specifically triggered through the public API interface. It does not require unusual or complex user interactions; rather, it is accessible via standard network requests directed at the API. It is important to note that actions performed through non-API interfaces or within internal management consoles not exposed to the public API vector may not activate this specific path.

Do I need to worry about CVE-2024-12108?

You should prioritize this if your instance is network-accessible. According to Halo Surface Signal, WhatsUp Gold is frequently deployed as an edge service or central portal, making its public API a likely target. If your installation is reachable over a network—especially if the API is exposed to facilitate remote monitoring or third-party integrations—the risk of interaction is higher.

What is the first step to address this risk?

Begin by auditing your environment to locate all running instances of WhatsUp Gold and verify their version numbers. Confirm whether the public API is active and reachable across your network boundaries. Once identified, coordinate with the infrastructure teams responsible for these systems to plan for updates, as the vulnerability affects versions released before 2024.0.2.

References

www.progress.com/network-monitoring

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.