Critical severity9.8NVD Advisory· Published Jun 25, 2024· Updated Jun 17, 2026

CVE-2024-4883

Description

In WhatsUp Gold versions released before 2023.1.3, a Remote Code Execution issue exists in Progress WhatsUp Gold. This vulnerability allows an unauthenticated attacker to achieve the RCE as a service account through NmApi.exe.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

Progress (organisation)/Whatsup Gold3 versions
cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*+ 2 more
- cpe:2.3:a:progress:whatsup_gold:*:*:*:*:*:*:*:*range: <23.1.3
- (no CPE)range: <2023.1.3
- (no CPE)range: 2023.1.0

Patches

Vulnerability mechanics

References

community.progress.com/s/article/WhatsUp-Gold-Security-Bulletin-June-2024nvdVendor Advisory
www.progress.com/network-monitoringnvdProduct

News mentions

No linked articles in our index yet.

Severity

CriticalCVSS v3.1

9.8/ 10

Attack vector: Network
Complexity: Low
Privileges: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

Probability of exploitation in the next 30 days.

64.78%

VYPR risk score

Composite of severity, exploitation, and reach.

0.69high

cvss	0.637
epss	0.052
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

Weaknesses

CWE-77
Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-78
Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-94
Improper Control of Generation of Code ('Code Injection')

CVE ID

CVE-2024-4883

Credits

SK
Sina Kheirkhah (@SinSinology) of Summoning Team (@SummoningTeam) working with Trend Micro Zero Day Initiative
finder