CVE-2024-12106: LDAP Configuration Vulnerability in WhatsUp Gold

The ability for an unauthenticated attacker to configure LDAP settings within WhatsUp Gold represents a severe security risk. Attackers could potentially manipulate LDAP configurations to redirect authentication requests, inject malicious data, or gain unauthorized access to sensitive information stored within the LDAP directory. This could lead to data breaches, privilege escalation, and ultimately, complete system compromise. The lack of authentication required for this configuration change significantly broadens the attack surface and increases the likelihood of exploitation. Successful exploitation could allow attackers to impersonate legitimate users, access confidential data, and disrupt WhatsUp Gold's monitoring capabilities.

1. Reserved2024-12-03
2. Published2024-12-31
3. Modified2025-01-04
4. EPSS updated2026-04-02

The primary mitigation for CVE-2024-12106 is to immediately upgrade WhatsUp Gold to version 2024.0.2 or later. If upgrading is not immediately feasible, consider temporarily restricting network access to the WhatsUp Gold server to prevent external attackers from exploiting the vulnerability. Review existing LDAP configurations for any suspicious changes. While not a complete solution, implementing strong authentication and access controls within the LDAP directory itself can help limit the potential impact of a successful attack. After upgrading, confirm the fix by verifying that unauthenticated users can no longer modify LDAP settings through the WhatsUp Gold interface.