The Positive Technologies experts discovered vulnerabilities in WhatsUp Gold by Ipswitch. This software allows automatic detection of network resources and their interaction, defining network status and availability, and for managing configuration.
“Use of the vulnerable version of WhatsUp Gold in a manufacturing company may cause cyberincidents and even disrupt the technological process,” says Head of ICS Security at Positive Technologies Vladimir Nazarov.
“Such products might have access to a significant part of network equipment, including network devices that are located in the technological segment. That is why it is crucial to eliminate detected vulnerabilities in such software because it is of major interest for attackers.”
One of the vulnerabilities (CVE-2018-5777) in Ipswitch WhatsUp allows a remote attacker to use incorrect configuration of an TFTP server to execute arbitrary commands in the server’s operating system. An intruder can access the entire infrastructure on the server and create space for further attacks against the infrastructure.
Another vulnerability detected by the PT specialists (CVE-2018-5778) is caused by insufficient filtering of user input on certain web pages of WhatsUp Gold and allows SQL Injection. This vulnerability gives an attacker various opportunities depending on DBMS configuration, from unauthorized access to the software database through to arbitrary code execution. As a result, the attacker can access accounts that are stored in the vulnerable system’s database and used for network equipment control.
To eliminate these vulnerabilities, it is recommended to update WhatsUp Gold to the version not earlier than WhatsUp Gold 2017 Plus Service Pack 2 (v.17.1.2).
About Positive Technologies
Positive Technologies is a leading global provider of enterprise security solutions for vulnerability and compliance management, incident and threat analysis, and application protection. Commitment to clients and research has earned Positive Technologies a reputation as one of the foremost authorities on Industrial Control System, Banking, Telecom, Web Application, and ERP security, supported by recognition from the analyst community. Learn more about Positive Technologies at ptsecurity.com.
