CVE-2025-2572: Progress WhatsUp Gold Auth Bypass Flaw

CVE-2025-2572 Overview

CVE-2025-2572 affects Progress WhatsUp Gold versions released before 2024.0.3. The vulnerability allows an unauthenticated remote attacker to modify the contents of the WhatsUp.dbo.WrlsMacAddressGroup database table. The flaw is categorized under [CWE-287] Improper Authentication, indicating that database write operations proceed without validating the caller's identity. Progress addressed the issue in WhatsUp Gold 2024.0.3.

Critical Impact
Unauthenticated attackers reachable over the network can tamper with wireless MAC address group records in the WhatsUp Gold database, compromising the integrity of network monitoring data.

Affected Products

Progress WhatsUp Gold versions prior to 2024.0.3
Component: progress:whatsup_gold
Fixed release: WhatsUp Gold 2024.0.3

Discovery Timeline

2025-04-14 - CVE-2025-2572 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-2572

Vulnerability Analysis

WhatsUp Gold is a network monitoring platform from Progress Software. In releases prior to 2024.0.3, an exposed code path permits write access to the WhatsUp.dbo.WrlsMacAddressGroup table without requiring authentication. This table stores wireless MAC address group definitions used by the wireless monitoring subsystem.

The vulnerability affects data integrity only. Confidentiality and availability are not directly impacted, according to the published CVSS vector. However, tampered MAC address group data can degrade the reliability of alerting and asset tracking within the monitoring workflow.

An unauthenticated attacker with network reachability to the WhatsUp Gold web tier can invoke the vulnerable functionality remotely. No user interaction is required, and attack complexity is low.

Root Cause

The root cause is improper authentication ([CWE-287]) on a request handler that manipulates the WrlsMacAddressGroup table. The endpoint fails to enforce session or role validation before executing database write operations. This allows arbitrary callers to insert, update, or delete rows in the affected table.

Attack Vector

The attack vector is network-based. An attacker sends crafted HTTP requests to the WhatsUp Gold management interface targeting the vulnerable endpoint. Because authentication is not enforced, the server processes the database modification directly. Successful exploitation results in unauthorized changes to wireless MAC address group records, which downstream monitoring logic consumes as trusted configuration data.

No public proof-of-concept exploit is available at this time, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2025-2572

Indicators of Compromise

Unexpected INSERT, UPDATE, or DELETE statements against WhatsUp.dbo.WrlsMacAddressGroup in SQL Server audit logs.
Unauthenticated HTTP requests to WhatsUp Gold API endpoints handling wireless MAC address group operations.
Anomalous changes to wireless monitoring group configurations without a corresponding administrator session.

Detection Strategies

Enable SQL Server auditing on the WhatsUp database to capture data manipulation events against WrlsMacAddressGroup.
Correlate IIS or web server access logs with authenticated session identifiers to flag unauthenticated requests reaching sensitive endpoints.
Baseline legitimate administrator activity against wireless MAC address group tables and alert on deviations.

Monitoring Recommendations

Restrict management interface access to trusted administrative networks and monitor perimeter logs for unexpected source addresses.
Track WhatsUp Gold version inventory to ensure hosts running versions prior to 2024.0.3 are prioritized for patching.
Review release notes and vendor advisories from Progress on an ongoing basis for related fixes.

How to Mitigate CVE-2025-2572

Immediate Actions Required

Upgrade WhatsUp Gold to version 2024.0.3 or later, which contains the vendor fix.
Inventory all WhatsUp Gold instances and confirm patch status against the fixed release.
Limit network exposure of the WhatsUp Gold management interface to trusted administrative subnets.

Patch Information

Progress released the fix in WhatsUp Gold 2024.0.3. Consult the Progress WhatsUp Gold Release Notes for upgrade instructions and version-specific notes. General product information is available on the Progress Network Monitoring Overview page.

Workarounds

Place WhatsUp Gold behind a reverse proxy or web application firewall that enforces authentication before requests reach the application.
Apply network access control lists to restrict inbound connections to the WhatsUp Gold web tier from known administrative hosts only.
Increase database auditing on the WhatsUp database until the upgrade to 2024.0.3 is completed.

bash

# Configuration example: restrict WhatsUp Gold web access via Windows Firewall
New-NetFirewallRule -DisplayName "WhatsUpGold-AdminOnly" \
  -Direction Inbound \
  -Protocol TCP \
  -LocalPort 9643 \
  -RemoteAddress 10.0.0.0/24 \
  -Action Allow