10

CVE-2024-1212

Warning

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

Data is provided by the National Vulnerability Database (NVD)
Progress ≫ Loadmaster Version >= 7.2.48.1 < 7.2.48.10
Progress ≫ Loadmaster Version >= 7.2.54.0 < 7.2.54.8
Progress ≫ Loadmaster Version >= 7.2.55.0 < 7.2.59.2

18.11.2024: CISA Known Exploited Vulnerabilities (KEV) Catalog

Progress Kemp LoadMaster OS Command Injection Vulnerability

Vulnerability

Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.

Description

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Required actions
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 94.36% 1
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.8 3.9 5.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security@progress.com 10 3.9 6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.