CVE-2024-5009 Overview
CVE-2024-5009 is an Improper Access Control vulnerability [CWE-269] in Progress WhatsUp Gold, a network monitoring product. The flaw exists in the Wug.UI.Controllers.InstallController.SetAdminPassword method. Local attackers can invoke this method to change the administrator password without authentication. The vulnerability affects WhatsUp Gold versions released before 2023.1.3. A successful attack yields full administrative control of the WhatsUp Gold console and its monitored assets.
Critical Impact
Local attackers can reset the WhatsUp Gold administrator password and take over the network monitoring platform, gaining privileged visibility and control across monitored infrastructure.
Affected Products
- Progress WhatsUp Gold versions prior to 2023.1.3
- Wug.UI.Controllers.InstallController component
- WhatsUp Gold web UI installations exposed to local access
Discovery Timeline
- 2024-06-25 - CVE-2024-5009 published to the National Vulnerability Database
- June 2024 - Progress releases the WhatsUp Gold Security Bulletin addressing the issue
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2024-5009
Vulnerability Analysis
The vulnerability resides in the SetAdminPassword action of the InstallController class in the WhatsUp Gold web UI. This controller endpoint is intended to run only during initial product installation, when an administrator sets the initial password. In affected releases, the endpoint remains reachable after installation completes and does not enforce authentication or authorization checks. Any actor able to reach the endpoint locally can invoke it and overwrite the stored administrator credentials.
Because WhatsUp Gold is a privileged network monitoring platform, an attacker who takes over the admin account inherits credentials, SNMP community strings, WMI credentials, and connectivity to every monitored device. This transforms a local access primitive into a broad lateral movement opportunity across the monitored estate.
Root Cause
The root cause is a missing access control check on an installation-time controller action [CWE-269]. InstallController.SetAdminPassword executes privileged state changes without validating whether the installer flow is still active or whether the caller holds administrative rights. The method should be disabled or gated once initial setup completes.
Attack Vector
Exploitation requires local access to the WhatsUp Gold server. An attacker with a low-privileged local account, or an attacker who has already obtained a foothold on the host, can send a crafted request to the SetAdminPassword action through the local web UI. The request rewrites the administrator password to an attacker-chosen value. The attacker then authenticates to the web console with the new credentials and operates as the platform administrator. Refer to the Progress Security Bulletin June 2024 for vendor-supplied technical details.
Detection Methods for CVE-2024-5009
Indicators of Compromise
- Unexpected HTTP requests to the Install/SetAdminPassword route in WhatsUp Gold IIS or web server logs after installation is complete.
- Administrator account password changes not initiated through the standard user management workflow.
- Successful admin logins from local accounts or hosts that have not previously accessed the WhatsUp Gold console.
- New or modified credentials, polling profiles, or scheduled tasks appearing in WhatsUp Gold shortly after suspicious local activity.
Detection Strategies
- Alert on any post-install invocation of InstallController endpoints, especially SetAdminPassword.
- Correlate administrator password change events with the identity of the process or user that initiated the request.
- Baseline normal administrative activity on the WhatsUp Gold host and flag deviations.
Monitoring Recommendations
- Forward IIS and WhatsUp Gold application logs to a centralized SIEM or data lake for retention and correlation.
- Monitor local logon events and process creation on the WhatsUp Gold server to identify precursor activity.
- Track configuration changes to monitored device credentials that occur immediately after an admin password change.
How to Mitigate CVE-2024-5009
Immediate Actions Required
- Upgrade WhatsUp Gold to version 2023.1.3 or later as instructed in the Progress Security Bulletin June 2024.
- Rotate the WhatsUp Gold administrator password and any credentials stored in the platform after patching.
- Restrict local and interactive logon rights on the WhatsUp Gold server to a minimal set of operators.
- Review authentication and configuration change logs for suspicious activity dating back to the install date.
Patch Information
Progress addressed CVE-2024-5009 in WhatsUp Gold 2023.1.3. Administrators should apply the fixed release and validate that installation-time endpoints are no longer reachable. Refer to the Progress Security Bulletin June 2024 for the authoritative patch matrix.
Workarounds
- Limit network and console access to the WhatsUp Gold server to trusted administrators only until patching is complete.
- Segment the WhatsUp Gold host from general user workstations to reduce the local attack surface.
- Enforce host-based access controls that block non-administrative accounts from interacting with the WhatsUp Gold web UI locally.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
