CVE-2024-4883

What it actually does

CVE-2024-4883 is an unauthenticated remote code execution vulnerability in Progress WhatsUp Gold versions earlier than 2023.1.3. The flaw is reachable over the network and can allow an attacker to execute operating-system commands through NmApi.exe without credentials or user interaction. Successful exploitation runs code in the context of the WhatsUp Gold service account, which may have access to monitoring data, stored credentials, network device integrations, scripts, and adjacent infrastructure depending on deployment configuration.

Why it matters to the business

A compromised WhatsUp Gold server can become a high-value foothold because monitoring platforms commonly have broad visibility across networks and may store credentials or automation capabilities for routers, switches, servers, cloud services, and databases. Exploitation could lead to service disruption, theft of monitoring data or credentials, lateral movement, tampering with alerts to hide other activity, and full compromise of systems reachable from the monitoring server. The CVSS score is critical at 9.8 and EPSS is elevated at approximately 0.65, indicating meaningful likelihood of exploitation even though it is not currently listed in CISA KEV and no ransomware use is indicated in the provided data.

How an attack unfolds

An attacker first identifies an exposed WhatsUp Gold instance, typically by scanning for the web interface or NmApi.exe-related routes. If the instance is running a vulnerable version before 2023.1.3, the attacker sends a crafted unauthenticated request to the vulnerable NmApi.exe component. The vulnerable service processes the request in a way that results in attacker-controlled code or commands being executed under the WhatsUp Gold service account. After initial execution, the attacker may run discovery commands, retrieve configuration files, access stored credentials, deploy a web shell or remote access tool, create scheduled tasks or services for persistence, and pivot to systems monitored or reachable by the WhatsUp Gold server.

How to fix it

Upgrade Progress WhatsUp Gold to version 2023.1.3 or later. If immediate upgrade is not possible, restrict network access to the WhatsUp Gold web interface and NmApi.exe endpoints to trusted administrative networks only, block direct internet exposure, enforce segmentation around the monitoring server, and monitor for suspicious process creation from WhatsUp Gold components. Rotate credentials stored in or used by WhatsUp Gold if exploitation is suspected, especially service account credentials, device credentials, API tokens, and integration secrets. Review service account privileges and reduce them to the minimum required for monitoring operations.

How to confirm the fix worked

Confirm the installed WhatsUp Gold version is 2023.1.3 or later through the product UI, installer inventory, file version metadata, or vendor-supported version checks. Validate that NmApi.exe is not reachable from untrusted networks and that only expected administrative sources can access the WhatsUp Gold application. Perform a safe authenticated configuration review to confirm the upgrade completed successfully and all services restarted. Review vulnerability scanner results for lingering detections of WhatsUp Gold versions before 2023.1.3. Where possible, verify Windows process creation logging is enabled so attempts to spawn command interpreters or scripting engines from WhatsUp Gold components can be detected.

Typical attack path

1. Scan the internet or internal network for exposed Progress WhatsUp Gold instances.
2. Fingerprint the application version or infer vulnerability based on NmApi.exe behavior and server responses.
3. Send a crafted unauthenticated request to the vulnerable NmApi.exe component.
4. Execute commands as the WhatsUp Gold service account.
5. Perform host and network discovery from the monitoring server.
6. Access WhatsUp Gold configuration data, stored credentials, scripts, logs, or device inventories.
7. Establish persistence using scheduled tasks, services, web shells, or remote management tooling.
8. Use the monitoring server’s network reachability and credentials to move laterally or disrupt monitoring and alerting.

How to detect it

Check for evidence of exploitation in web server logs, WhatsUp Gold application logs, Windows Security logs, Sysmon or EDR telemetry, PowerShell operational logs, scheduled task logs, service control manager events, and outbound proxy/firewall records. Focus on unauthenticated or unusual requests involving NmApi.exe, especially from unfamiliar IP addresses, followed by process creation by NmApi.exe, w3wp.exe, or other WhatsUp Gold service processes. Look for child processes such as cmd.exe, powershell.exe, pwsh.exe, certutil.exe, bitsadmin.exe, mshta.exe, rundll32.exe, regsvr32.exe, curl.exe, wget.exe, net.exe, nltest.exe, whoami.exe, ipconfig.exe, or tasklist.exe. Investigate new or modified files in WhatsUp Gold installation and web directories, unexpected scheduled tasks, newly created services, new local users, changes to firewall rules, and outbound connections to unfamiliar hosts shortly after NmApi.exe requests. If threat hunting identifies likely exploitation, collect memory, relevant logs, file system timestamps, persistence locations, and credential-access evidence before remediation where possible.

• NmApi.exe
• /NmApi.exe
• /NmAPI
• cs-uri-stem=/NmApi.exe
• ParentImage=*\\NmApi.exe
• ParentImage=*\\w3wp.exe Image=*\\cmd.exe
• ParentImage=*\\w3wp.exe Image=*\\powershell.exe
• ParentImage=*\\NmApi.exe Image=*\\cmd.exe
• ParentImage=*\\NmApi.exe Image=*\\powershell.exe
• ParentImage=*\\NmApi.exe Image=*\\pwsh.exe
• ParentImage=*\\NmApi.exe Image=*\\certutil.exe
• ParentImage=*\\NmApi.exe Image=*\\bitsadmin.exe
• ParentImage=*\\NmApi.exe Image=*\\mshta.exe
• ParentImage=*\\NmApi.exe Image=*\\rundll32.exe
• ParentImage=*\\NmApi.exe Image=*\\regsvr32.exe
• ParentImage=*\\NmApi.exe Image=*\\curl.exe
• ParentImage=*\\NmApi.exe Image=*\\wget.exe
• Event ID 4688 NmApi.exe
• Event ID 7045
• Microsoft-Windows-PowerShell/Operational Event ID 4104
• schtasks /create
• sc create
• net user
• net localgroup administrators

What your security team should do

• Prioritize upgrade to WhatsUp Gold 2023.1.3 or later because the vulnerability is unauthenticated, network-reachable, critical severity, and has elevated EPSS likelihood.
• Immediately remove public internet access to WhatsUp Gold and allow access only from trusted administrative networks or VPNs.
• Hunt for evidence of prior exploitation using web logs, WhatsUp Gold logs, Windows process creation events, PowerShell logs, scheduled task logs, and outbound network telemetry.
• Alert on NmApi.exe or WhatsUp Gold-related web worker processes spawning shells, scripting engines, file transfer utilities, or credential-dumping tools.
• If suspicious activity is found, isolate the server, preserve forensic evidence, rotate WhatsUp Gold-managed credentials and service account credentials, and review monitored systems for lateral movement.
• Reduce privileges of the WhatsUp Gold service account and separate monitoring credentials by device or platform where feasible.
• Add compensating controls such as WAF rules, network ACLs, EDR detections, and egress filtering around the monitoring server.