All vulnerabilities
CVE-2024-1212

Progress Kemp LoadMaster OS Command Injection Vulnerability

Progress Kemp LoadMaster
Open in ThreatlineRecord JSON
CVSS
10.0Critical
ExploitationExploited in the wildAdded to KEV 18 Nov 2024CISA KEV
Exploit odds (EPSS)95.4%Chance of exploitation activity in the next 30 days, higher than 99% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in7.2.48.10Also 7.2.54.8, 7.2.59.2CVE List
Federal deadline9 Dec 2024Remediation due date for US federal agenciesCISA KEV
CISA required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. CISA KEV

What fixes it

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Timeline

  1. 21 Feb 2024, 17:39 UTCPublishedCVE List
  2. 19 Mar 2024Exploit code publicMetasploit
  3. 18 Nov 2024Added to CISA KEVCISA KEV

Public exploit code and templates 3

  • Exploit moduleKemp LoadMaster Local sudo privilege escalation 19 Mar 2024Metasploit
  • Exploit moduleKemp LoadMaster Unauthenticated Command Injection 19 Mar 2024Metasploit
  • Scanner templateProgress Kemp LoadMaster - Command InjectionNuclei

Listed so defenders can prioritize. Threatline links to the source and does not host exploit code.

Description

Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.

Text from CVE List

Affected versions 3

  • LoadMasteraffected: 7.2.48.1 before 7.2.48.10CVE List
  • LoadMasteraffected: 7.2.54.0 before 7.2.54.8CVE List
  • LoadMasteraffected: 7.2.55.0 before 7.2.59.2CVE List

References 7