CVE-2022-29847

What it actually does

The vulnerability allows an unauthenticated network attacker to trigger a WhatsUp Gold API workflow that causes the application to forward encrypted WhatsUp Gold user credentials to an attacker-controlled host. Technically, this is a server-side request/credential-relay issue: the attacker does not need valid credentials, user interaction, or local access, and the vulnerable WhatsUp Gold server becomes the system that initiates the outbound connection and transmits sensitive credential material. The primary impact is confidentiality loss of WhatsUp Gold user credentials; integrity and availability are not the direct impact described by the CVSS vector.

Why it matters to the business

A successful attack can expose credentials used to administer or access a network monitoring platform. Because WhatsUp Gold commonly has broad visibility into infrastructure, stolen credentials may help an attacker understand monitored assets, pivot toward administrative systems, or support follow-on intrusion activity. The issue is weaponized and has a high EPSS score, so externally reachable WhatsUp Gold instances should be treated as high-priority even though the vulnerability is not currently listed in CISA KEV and is not specifically marked as ransomware-associated.

How an attack unfolds

An attacker first identifies an exposed WhatsUp Gold web interface running a vulnerable version, specifically 21.0.0 through 21.1.1 or 22.0.0. The attacker then sends a crafted unauthenticated request to the vulnerable API transaction and supplies an attacker-controlled destination host. The WhatsUp Gold server processes the transaction without proper authentication or destination validation and initiates an outbound connection to that destination. During that workflow, encrypted WhatsUp Gold user credential material is relayed to the attacker-controlled host. The attacker can then retain that credential material for offline analysis, replay opportunities, or additional attacks against WhatsUp Gold and surrounding infrastructure depending on how the credentials are protected and used.

How to fix it

Upgrade WhatsUp Gold to a vendor-supported release that contains the fix for this vulnerability. Because no exact fixed version was provided in the input, treat all WhatsUp Gold 21.0.0 through 21.1.1 and 22.0.0 installations as vulnerable until confirmed patched by Progress/Ipswitch release notes or support. If immediate upgrade is not possible, restrict access to the WhatsUp Gold web interface and API to trusted administrative networks only, block direct internet exposure, enforce egress filtering so the WhatsUp Gold server cannot initiate arbitrary outbound connections, and monitor or block unexpected outbound HTTP/HTTPS/DNS connections from the WhatsUp Gold host. Rotate WhatsUp Gold user credentials and any credentials reused elsewhere if exploitation is suspected.

How to confirm the fix worked

Confirm the installed WhatsUp Gold version is not 21.0.0, 21.1.0, 21.1.1, or 22.0.0 and that the deployed build is listed by the vendor as fixed. Validate that the WhatsUp Gold web interface is not publicly reachable unless explicitly required and protected by compensating controls. Test egress controls by confirming the WhatsUp Gold server cannot initiate outbound connections to arbitrary external hosts. Review web/API access logs to ensure unauthenticated requests to WhatsUp Gold API paths are rejected or do not trigger outbound callbacks. Where safe and authorized, use an internal vulnerability scanner or vendor-supported check to verify the CVE is no longer reported.

Typical attack path

1. Discover an internet-facing or otherwise reachable WhatsUp Gold web server.
2. Fingerprint the application version or behavior to determine whether it is in the vulnerable 21.0.0 through 21.1.1 or 22.0.0 range.
3. Prepare an attacker-controlled listener or web service to receive outbound traffic from the WhatsUp Gold server.
4. Send a crafted unauthenticated request to the affected API transaction, specifying the attacker-controlled host as the relay destination.
5. Wait for the WhatsUp Gold server to make the outbound connection and transmit encrypted user credential material.
6. Use the captured material to support credential analysis, replay attempts, or follow-on access attempts against WhatsUp Gold or related systems.

How to detect it

Look for evidence that the WhatsUp Gold server received unauthenticated API requests and then initiated unexpected outbound traffic to external destinations. Useful log sources include WhatsUp Gold web/application logs, Microsoft IIS logs if IIS is used, reverse proxy or WAF logs, perimeter firewall logs, DNS resolver logs, EDR network telemetry, and NetFlow. Investigate requests to WhatsUp Gold API paths from unauthenticated or unknown source IPs, especially requests followed within seconds or minutes by outbound HTTP/HTTPS connections from the WhatsUp Gold server to unfamiliar hosts. Hunt for unusual external DNS lookups or connections from the WhatsUp Gold process identity or web server process. Because the vulnerability relays encrypted credential material, the payload may not be human-readable; focus on suspicious request patterns, callback behavior, unknown destinations, and timing correlation rather than plaintext credential strings. If exploitation is suspected, preserve logs, capture destination IPs/domains, rotate WhatsUp Gold credentials, and review account activity for follow-on use.

• /NmAPI/
• GET /NmAPI/
• POST /NmAPI/
• WhatsUp Gold
• Ipswitch WhatsUp Gold
• WhatsUpGold

What your security team should do

• Prioritize patching or upgrading vulnerable WhatsUp Gold deployments because exploitation is weaponized and the EPSS score indicates meaningful likelihood of exploitation.
• Immediately remove public exposure of WhatsUp Gold web/API interfaces where possible; limit access to VPN, bastion, or trusted administrative networks.
• Implement outbound firewall rules that restrict the WhatsUp Gold server to required destinations only, reducing the ability to relay credentials to attacker-controlled infrastructure.
• Review recent outbound connections from WhatsUp Gold servers for unexpected external IPs or domains, especially connections occurring immediately after unauthenticated web/API requests.
• Rotate WhatsUp Gold user credentials and investigate privileged accounts if suspicious API activity or unusual outbound callbacks are found.
• Add SIEM detections for unauthenticated requests to WhatsUp Gold API endpoints followed by outbound HTTP/HTTPS traffic from the WhatsUp Gold host.
• Retain web server, application, proxy, EDR, firewall, and DNS logs long enough to cover the period before remediation, because exploitation may not leave obvious application-side artifacts.