CVE-2024-8785
Progress Whatsup Gold ≤ 24.0.1
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HSummary
CVE-2024-8785 is a critical-severity Incorrect Use of Privileged APIs (CWE-648) vulnerability in Progress Whatsup Gold. Its CVSS base score is 9.8 (Critical).
Operationally, exploitation aligns with the MITRE ATT&CK technique Abuse Elevation Control Mechanism (T1548); ranked in the top 5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SA-11 (Developer Testing and Evaluation) and AC-3 (Access Enforcement) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2024-8785 affects WhatsUp Gold versions prior to 2024.0.1 and stems from improper access controls in the NmAPI.exe component. The flaw permits modification of registry values under the HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\ path without authentication, corresponding to CWE-648.
A remote attacker with no credentials can send crafted requests to NmAPI.exe over the network to create or alter registry entries. Successful exploitation grants the ability to modify system configuration data, which under the CVSS vector yields full confidentiality, integrity, and availability impact with a score of 9.8.
Progress Software advisories direct customers to upgrade to WhatsUp Gold 2024.0.1 or later; the associated release notes confirm that the registry modification path is restricted after the update. The referenced security bulletin and product documentation provide the primary remediation guidance.
EPSS for the CVE rose from a low baseline to a peak of 0.1102 on 2025-12-11 before receding to the current value of 0.0404, indicating a period of increased exploitation interest following disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-49604
Vulnerability Data
In WhatsUp Gold versions released before 2024.0.1, a remote unauthenticated attacker could leverage NmAPI.exe to create or change an existing registry value in registry path HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Ipswitch\.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
—
V3.5.2V6.4.6
Mitigating Controls (NIST 800-53 r5) AI
Developer testing and evaluation can discover incorrect calls to privileged APIs before deployment.
Enforces authorization checks around privileged operations so that an API requiring elevated rights cannot be reached or misused without proper rights.
Least-privilege assignment directly reduces both the availability of privileged APIs and the blast radius when they are invoked incorrectly.
Security engineering principles include correct use of privileged interfaces and safe invocation patterns that stop the weakness from being introduced.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Secure SDLC practices directly enforce correct usage of privileged APIs during development.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Security testing can detect incorrect privileged API calls but does not prevent them at design time.
Restricting privileged utility programs limits the exposure of privileged APIs to misuse.
Privileged access rights directly govern the correct use of privileged APIs and reduce misuse.
Secure development lifecycle includes API usage standards that can prevent incorrect privileged calls.
Application security requirements can specify correct invocation of privileged APIs.
Secure architecture principles guide proper privilege separation and API usage.