CVE-2006-2354: NmConsole/Login.asp in Ipswitch WhatsUp Professional 2006 and Ipswitch WhatsUp Professional 2006 Premium ge...

Security readout for executives and security teams

This CVE describes an information leak in the login page of Ipswitch WhatsUp Professional 2006 and 2006 Premium. The page reportedly gives different errors for valid versus invalid usernames, letting a remote attacker learn account names. That lowers the effort for password attacks, but active exploitation is not evidenced and severity data is missing. Exposure is most likely where legacy WhatsUp Professional 2006 management consoles remain reachable over a network, especially from the internet. Modern WhatsUp products are not named in the provided sources. Treat as a legacy exposure and credential-risk issue. It is not enough to justify emergency response from the provided evidence, but any internet-facing 2006 management console should be prioritized for isolation or retirement. Mitigation focus: Check vendor guidance for supported fixes or upgrade paths.; Remove unsupported WhatsUp Professional 2006 instances from production.; Restrict console access to trusted admin networks or VPN..

Prepared

Jun 29, 2026, 12:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.