CVE-2024-4885

What it actually does

CVE-2024-4885 is an unauthenticated network-accessible remote code execution flaw in Progress WhatsUp Gold versions before 2023.1.3. The vulnerable component, WhatsUp.ExportUtilities.Export.GetFileWithoutZip, can be reached without authentication and can be abused to execute operating-system commands in the context of the IIS application pool identity, reported as iisapppool\nmconsole. Because the service account belongs to the monitoring application tier, successful exploitation can expose monitoring credentials, device inventories, alerting data, stored integrations, and may provide a foothold for lateral movement into managed network infrastructure.

Why it matters to the business

This is a high-urgency issue: it has a CVSS score of 9.8, very high EPSS likelihood, is listed in CISA KEV, and is reported as actively exploited in the wild. A compromised monitoring server can give attackers visibility into critical infrastructure, credentials, network topology, and administrative workflows, potentially leading to outage, data theft, broader compromise of managed systems, and loss of trust in operational monitoring. The CISA remediation deadline of 2025-03-24 has passed, so any remaining exposure should be treated as overdue and high priority.

How an attack unfolds

An attacker first identifies an internet-facing or reachable WhatsUp Gold instance running a vulnerable version before 2023.1.3. They send a crafted unauthenticated request to the vulnerable export utility function, WhatsUp.ExportUtilities.Export.GetFileWithoutZip, causing the application to execute attacker-controlled commands under the IIS application pool account used by the nmconsole application. After gaining command execution, the attacker typically performs discovery, confirms privileges, writes or downloads tools, establishes persistence if possible, and pivots toward stored credentials, configuration files, managed device data, and internal systems visible from the monitoring server. Public reporting and KEV status indicate this class of Progress WhatsUp Gold exploitation has been used in active campaigns, so exposed systems should be investigated, not merely patched.

How to fix it

Upgrade Progress WhatsUp Gold to version 2023.1.3 or later immediately. If immediate upgrade is not possible, restrict access to the WhatsUp Gold web interface to trusted administrative networks or VPNs, block public internet exposure, enforce web application firewall rules for suspicious export utility requests, and monitor for command execution from IIS worker processes. Rotate credentials and API tokens stored in or used by WhatsUp Gold after remediation if exploitation is suspected. The supplied package metadata also lists FRRouting package fixes: Debian 13 frr fixed in 10.0.1-0.1, Ubuntu 22.04 LTS frr fixed in 8.1-1ubuntu1.10, and Ubuntu 24.04 LTS frr fixed in 8.4.4-1.1ubuntu6.1; however, the vulnerability description identifies Progress WhatsUp Gold, so validate package applicability against the relevant vendor advisory before treating FRR upgrades as remediation for this issue.

How to confirm the fix worked

Confirm the installed Progress WhatsUp Gold version is 2023.1.3 or later using the application UI, installed-program inventory, vendor update tooling, or file/package version checks. Confirm the WhatsUp Gold web interface is not exposed to untrusted networks unless explicitly required and protected. Review IIS and application logs for requests referencing Export.GetFileWithoutZip or related export utility paths before and after patching. Validate that the IIS application pool identity cannot execute unexpected child processes and that EDR or Sysmon policy records process creation from w3wp.exe. Where FRR package advisories are in scope, validate package versions with distro package tooling such as dpkg-query and confirm Debian/Ubuntu fixed versions are installed.

Typical attack path

1. Scan for exposed Progress WhatsUp Gold web interfaces or management portals.
2. Fingerprint the application version or infer vulnerability from exposed behavior.
3. Send an unauthenticated crafted request targeting WhatsUp.ExportUtilities.Export.GetFileWithoutZip.
4. Achieve command execution as the IIS application pool identity, such as iisapppool\nmconsole.
5. Run reconnaissance commands to identify host privileges, network access, installed tools, and application paths.
6. Access WhatsUp Gold configuration, credentials, logs, managed-device data, or integration secrets where available.
7. Deploy follow-on tooling, web shells, scheduled tasks, services, or remote access mechanisms.
8. Use the monitoring server’s trusted position to move laterally or target managed infrastructure.

How to detect it

Look for evidence of exploitation in IIS web logs, WhatsUp Gold application logs, Windows Security logs, Sysmon or EDR process telemetry, PowerShell logs, scheduled task logs, and network egress records. Prioritize requests containing GetFileWithoutZip, WhatsUp.ExportUtilities.Export, or unusual export-related parameters, especially from unauthenticated sessions or unfamiliar external IP addresses. On Windows hosts, search for process creation where w3wp.exe spawns cmd.exe, powershell.exe, pwsh.exe, certutil.exe, bitsadmin.exe, curl.exe, wget.exe, mshta.exe, rundll32.exe, regsvr32.exe, net.exe, net1.exe, whoami.exe, nltest.exe, or other administrative tools. Review filesystem changes under the WhatsUp Gold web and application directories for recently created ASPX files, scripts, archives, or binaries. Investigate outbound connections from the WhatsUp Gold server to unknown external IPs, especially shortly after suspicious export utility requests. Because this vulnerability is KEV-listed and actively exploited, absence of a single IOC is not sufficient; combine version exposure, request traces, process lineage, file creation, and credential-use review.

• WhatsUp.ExportUtilities.Export.GetFileWithoutZip
• Export.GetFileWithoutZip
• GetFileWithoutZip
• WhatsUp.ExportUtilities.Export
• iisapppool\nmconsole
• IIS APPPOOL\nmconsole
• w3wp.exe -> cmd.exe
• w3wp.exe -> powershell.exe
• w3wp.exe -> pwsh.exe
• w3wp.exe -> certutil.exe
• w3wp.exe -> bitsadmin.exe
• w3wp.exe -> curl.exe
• w3wp.exe -> wget.exe
• w3wp.exe -> mshta.exe
• w3wp.exe -> rundll32.exe
• w3wp.exe -> regsvr32.exe
• w3wp.exe -> whoami.exe
• w3wp.exe -> net.exe
• w3wp.exe -> net1.exe
• w3wp.exe -> nltest.exe
• cmd.exe /c whoami
• powershell.exe -enc
• powershell.exe -EncodedCommand
• certutil.exe -urlcache
• bitsadmin /transfer

What your security team should do

• Treat any vulnerable internet-facing WhatsUp Gold instance as potentially compromised due to KEV listing, active exploitation, and very high EPSS probability.
• Upgrade WhatsUp Gold to 2023.1.3 or later and verify completion with asset inventory and authenticated version checks.
• Immediately remove direct internet exposure for WhatsUp Gold management interfaces; require VPN, private network access, or tightly scoped administrative allowlists.
• Hunt for exploitation using IIS logs, WhatsUp Gold logs, Windows process creation telemetry, EDR alerts, and command execution artifacts tied to w3wp.exe or the nmconsole application pool.
• Investigate for post-exploitation activity including new local users, scheduled tasks, dropped web shells, unusual PowerShell, outbound connections, credential access, and changes to monitoring configuration.
• Rotate credentials, API keys, SNMP strings, integration tokens, and service account secrets accessible to WhatsUp Gold if compromise cannot be ruled out.
• Add SIEM detections for unauthenticated requests to export utility functionality and for command interpreters spawned by IIS worker processes.
• Confirm whether distro package findings for frr are relevant to the organization’s exposure model and remediate to the listed fixed package versions where applicable.