CVE-2024-8785
📋 TL;DR
This vulnerability allows remote unauthenticated attackers to modify registry values in WhatsUp Gold installations, potentially enabling system compromise. It affects WhatsUp Gold versions before 2024.0.1. Attackers can leverage NmAPI.exe to write to the HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\ registry path.
💻 Affected Systems
- WhatsUp Gold
📦 What is this software?
Whatsup Gold by Progress
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through registry manipulation leading to remote code execution, persistence mechanisms, or disabling security controls.
Likely Case
Privilege escalation, service disruption, or installation of backdoors through registry modification.
If Mitigated
Limited impact if network segmentation and access controls prevent unauthorized access to WhatsUp Gold services.
🎯 Exploit Status
No authentication required, making exploitation straightforward for attackers with network access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2024.0.1 or later
Vendor Advisory: https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-September-2024
Restart Required: No
Instructions:
1. Download WhatsUp Gold 2024.0.1 or later from Progress website. 2. Run the installer to upgrade. 3. Verify installation completes successfully.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to WhatsUp Gold services to trusted IPs only
Use firewall rules to block external access to WhatsUp Gold ports (typically 80, 443, 8080)
Service Hardening
WindowsConfigure NmAPI.exe to require authentication or restrict its permissions
Review and modify NmAPI.exe service configuration to enforce authentication
🧯 If You Can't Patch
- Implement strict network segmentation to isolate WhatsUp Gold from untrusted networks
- Deploy application control to prevent unauthorized execution of NmAPI.exe modifications
🔍 How to Verify
Check if Vulnerable:
Check WhatsUp Gold version in application interface or registry at HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\WhatsUp Gold\VersionCheck Version:
reg query "HKLM\SOFTWARE\WOW6432Node\Ipswitch\WhatsUp Gold" /v VersionVerify Fix Applied:
Confirm version is 2024.0.1 or higher and test that NmAPI.exe no longer accepts unauthenticated registry modification requests📡 Detection & Monitoring
Log Indicators:
- Unusual registry modification events in Windows Security logs
- Access to NmAPI.exe from unauthorized sources
Network Indicators:
- Unexpected connections to WhatsUp Gold service ports from external IPs
- Traffic patterns indicating registry manipulation attempts
SIEM Query:
source="Windows Security" EventID=4657 OR EventID=4663 AND ObjectName="*NmAPI.exe*" OR "*Ipswitch*"