Actively exploited · Published Feb 21, 2024 · Assigned by ProgressSoftware
CVE-2024-1212LoadMaster Pre-Authenticated OS Command Injection
Critical 10.0 Exploited
In plain English
A critical-severity OS command injection in LoadMaster from Progress Software. Attackers are actively exploiting it in the wild (listed by CISA on November 18, 2024). The chance it is exploited in the next 30 days is estimated at 95.4% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, Nuclei, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Dec 9, 2024.
Official description
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | LoadMaster | 7.2.48.1 – before 7.2.48.107.2.54.0 – before 7.2.54.87.2.55.0 – before 7.2.59.2 |
Weakness: CWE-78 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
References
- https://kemptechnologies.com/ product
- https://freeloadbalancer.com/ product
- https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212 vendor-advisory
- https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212 vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1212 government-resource