CVE-2024-5016 is a high severity (CVSS 7.2) deserialization flaw in Progress WhatsUp Gold Distributed Edition before 2023.1.3. It can lead to remote code execution as SYSTEM. Upgrade every server and remote site to 2023.1.3 or later and restrict the distributed messaging port.
What's affected
Progress WhatsUp Gold versions released before 2023.1.3. Only Distributed Edition installations are described. The record names the message handlers NmDistributed.DistributedServiceBehavior.OnMessage on the server and NmDistributed.DistributedClient.OnMessage on clients, so both ends are affected. It also lists the 23.1.0 build among its products.
The record does not name a separate fixed build, but its wording means 2023.1.3 or later is outside the affected range. Confirm the exact fixed build and any hotfix steps in the Progress June 2024 security bulletin, which I could not load for this review.
The weakness class is CWE-502, deserialization of untrusted data. The record scores it 7.2 (High) with the vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.
How to check if you're exposed
WhatsUp Gold is a Windows application, so the check is a version check. Open the product's About information in the console, or look at the installed version in Windows Apps and Features, and compare it with 2023.1.3. Anything older is in the affected range.
Then check reachability. Note whether the web console is exposed to the internet or to wide internal networks, and who holds accounts on it. Check whether you run Distributed Edition at all. If you do, check each remote site, not just the central server, and confirm which networks can reach the distributed messaging service.
The 23.1.0 entry in the record is a product listing, and it can read as a version number that looks higher than 2023.1.3. Do not infer from it that 23.1.0 is safe. Check against the Progress bulletin.
What to do now
- Establish whether Distributed Edition is in use.
- Upgrade the central server and all remote sites to 2023.1.3 or later.
- Limit network access between sites to the specific addresses and ports that need to talk.
- Check hosts for unexpected processes running as SYSTEM.
- Read the Progress bulletin for the exact fixed build and upgrade order.
Why it matters
Deserialization of untrusted data, CWE-502, happens when a program rebuilds objects from bytes it received without checking what those bytes describe. In the worst case the data decides what code runs. The record says the result here is code execution as SYSTEM, the highest local Windows privilege.
The score is held to 7.2 by the privileges needed, but SYSTEM on a server that polls the whole network is a bad place to land. Distributed deployments also multiply the machines to patch. This is not listed as KEV in the record.
Quick check
Are single-server installs affected?
The record describes Distributed Edition installations. Still upgrade, since the same release fixes the other bulletin issues.
Sources
- Progress WhatsUp Gold Security Bulletin, June 2024 (linked from the record; the page would not load for me, so the version statements here come from the NVD record)
Last reviewed: 19 October 2026.
