Reference page — cumulative record through Sunday, October 4, 2026 UTC. Reference pages update as the archive grows; only dated daily editions are immutable pages of record.

CVE-2024-6670

CVE-2024-6670CRITICAL

Progress Software Corporation WhatsUp Gold — WhatsUp Gold HasErrors SQL Injection Authentication Bypass Vulnerability

  AV  AC  PR  UI  S  C  I  A   CVSS    EPSS   %ile   KEV
   N   L   N   N  U  H  H  H    9.8   .9300   99.8   YES

AFFECTED
  Product       Versions    Fixed
  WhatsUp Gold  2023.1.0 –  —

TIMELINE
  Jul 10  Reserved by ProgressSoftware
  Aug 29  Published (CNA: ProgressSoftware)
  Sep 16  Added to CISA KEV, remediation due 2024-10-07

CWE-89 · CNA: ProgressSoftware · CVSS v3.1 · 3 references · KEV due October 7, 2024

Description

In WhatsUp Gold versions released before 2024.0.0, a SQL Injection vulnerability allows an unauthenticated attacker to retrieve the users encrypted password.

Lifecycle

Complete event history — 3 events, chronological
Date	Event	Detail
July 10, 2024	Reserved	Reserved by ProgressSoftware
August 29, 2024	Published	Published (CNA: ProgressSoftware)
September 16, 2024	KEV ADDED	Added to CISA KEV, remediation due 2024-10-07

Affected

Affected products and packages — 1 row
Vendor	Product / Package	Ecosystem	Version introduced	Fixed
Progress Software Corporation	WhatsUp Gold	—	2023.1.0	—

Weaknesses

CWE-89

References (3)

https://community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-August-2024 [vendor-advisory]
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-6670 [government-resource]
https://www.progress.com/network-monitoring [product]

Authoritative record: CVE-2024-6670 at cve.org

Vendors: progress

Weaknesses: CWE-89

About this page

This is a reference page, not a dated page of record. It assembles the complete lifecycle of CVE-2024-6670 from the CVE Program record, NVD enrichment, the CISA KEV catalog, EPSS, and OSV advisories. The box score's numbers (CVSS, EPSS, KEV status) are current as of Sunday, October 4, 2026 UTC and are re-derived as the archive grows; only dated daily editions are immutable pages of record. The authoritative source for this identifier is cve.org.