The software is used by system administrators in banking, government, and manufacturing worldwide

The Positive Technologies experts discovered vulnerabilities in WhatsUp Gold by Ipswitch. This software allows automatic detection of network resources and their interaction, defining network status and availability, and for managing configuration.

"Use of the vulnerable version of WhatsUp Gold in a manufacturing company may cause cyberincidents and even disrupt the technological process," says Head of ICS Security at Positive Technologies Vladimir Nazarov.

"Such products might have access to a significant part of network equipment, including network devices that are located in the technological segment. That is why it is crucial to eliminate detected vulnerabilities in such software because it is of major interest for attackers."

One of the vulnerabilities (CVE-2018-5777) in Ipswitch WhatsUp allows a remote attacker to use incorrect configuration of an TFTP server to execute arbitrary commands in the server's operating system. An intruder can access the entire infrastructure on the server and create space for further attacks against the infrastructure.

Another vulnerability detected by the PT specialists (CVE-2018-5778) is caused by insufficient filtering of user input on certain web pages of WhatsUp Gold and allows SQL Injection. This vulnerability gives an attacker various opportunities depending on DBMS configuration, from unauthorized access to the software database through to arbitrary code execution. As a result, the attacker can access accounts that are stored in the vulnerable system's database and used for network equipment control.

To eliminate these vulnerabilities, it is recommended to update WhatsUp Gold to the version not earlier than WhatsUp Gold 2017 Plus Service Pack 2 (v.17.1.2).