CVE-2024-5009 is a high severity (CVSS 8.4) improper access control in Progress WhatsUp Gold before 2023.1.3. The InstallController SetAdminPassword function lets a local attacker modify the administrator's password. Upgrade to 2023.1.3 or later and restrict who can log on to the server.
What's affected
Progress WhatsUp Gold versions released before 2023.1.3. The component is the install-time SetAdminPassword action in Wug.UI.Controllers.InstallController, which is the same function behind the denial of service in CVE-2024-5013. The attack vector in the record is local.
The record does not name a separate fixed build, but its wording means 2023.1.3 or later is outside the affected range. Confirm the exact fixed build and any hotfix steps in the Progress June 2024 security bulletin, which I could not load for this review.
The weakness class is CWE-269, improper privilege management. The record scores it 8.4 (High) with the vector CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
WhatsUp Gold is a Windows application, so the check is a version check. Open the product's About information in the console, or look at the installed version in Windows Apps and Features, and compare it with 2023.1.3. Anything older is in the affected range.
Then check reachability. Note whether the web console is exposed to the internet or to wide internal networks, and who holds accounts on it. The vector is local, so also list who can sign in to the Windows host: administrators, remote desktop users, and service accounts.
What to do now
- Upgrade to 2023.1.3 or later, following the Progress bulletin.
- Reduce interactive and remote desktop access to the WhatsUp Gold server to the people who run it.
- Check the application's audit trail and your Windows event logs for unexpected admin password changes.
- If you cannot account for a change, reset the admin password and review stored credentials.
- Treat the host like any other system that holds monitoring credentials.
Why it matters
A setup step that should only run once, before the product is configured, stayed reachable after installation. That is the shape of CWE-269, improper privilege management: a function written for a trusted moment is callable at an untrusted one.
The local vector keeps the score at 8.4 rather than higher, but a local foothold on a shared Windows server is common after any other bug or a stolen low-privilege login. This is a good example of why chained, lower-severity findings deserve patching too. Not a KEV entry per the record.
Quick check
Is this a remote bug?
The record describes local attackers. Another entry in the same bulletin, CVE-2024-5013, concerns the same installation step from the network and causes denial of service.
Sources
- Progress WhatsUp Gold Security Bulletin, June 2024 (linked from the record; the page would not load for me, so the version statements here come from the NVD record)
Last reviewed: 19 October 2026.
