WhatsUp Gold WriteDataFile डायरेक्टरी ट्रावर्सल रिमोट कोड एग्जीक्यूशन भेद्यता

The impact of CVE-2024-4883 is severe. Successful exploitation grants an attacker complete control over the affected WhatsUp Gold server. This includes the ability to install malware, steal sensitive data (network configurations, performance metrics, credentials stored within the system), and potentially pivot to other systems on the network. Given WhatsUp Gold's role in network monitoring, an attacker could gain a comprehensive view of the entire network infrastructure, facilitating further reconnaissance and attacks. The lack of authentication required for exploitation significantly broadens the attack surface, making it accessible to a wide range of threat actors.

Organizations heavily reliant on WhatsUp Gold for network monitoring are at significant risk. This includes businesses with extensive network infrastructure, those using WhatsUp Gold for compliance monitoring, and those with limited security resources who may be slower to apply patches. Shared hosting environments where WhatsUp Gold is deployed could also be vulnerable if multiple tenants share the same server.

• windows / supply-chain:

Get-Process -Name NmApi -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Id

• windows / supply-chain:

Get-WinEvent -LogName Application -FilterXPath "*[System[Provider[@Name='WhatsUp Gold']]]" -MaxEvents 10

• windows / supply-chain: Check Autoruns for suspicious entries related to NmApi.exe or WhatsUp Gold.

1. 2024-06-25Disclosure

   disclosure

1. आरक्षित2024-05-14
2. प्रकाशित2024-06-25
3. संशोधित2024-08-01
4. EPSS अद्यतन2026-04-02

The primary mitigation for CVE-2024-4883 is to immediately upgrade WhatsUp Gold to version 2023.1.3 or later. If upgrading is not immediately feasible, consider isolating the affected server from the network to prevent external access. While not a complete solution, implementing strict firewall rules to restrict access to NmApi.exe on port 4986 can reduce the attack surface. Monitor network traffic for suspicious connections to port 4986. After upgrading, confirm the vulnerability is resolved by attempting to trigger the vulnerability using the original exploit vector and verifying that the execution is blocked.