CVE-2024-1212

An attacker gains access to the system through the LoadMaster management interface without requiring any credentials. The vulnerability is classified as command injection (CWE-78), meaning that input data supplied by the attacker is passed directly to the system shell without proper validation or sanitization. This allows execution of arbitrary commands with the privileges of the process handling the management interface.

An unauthenticated attacker can take full control of the device by executing arbitrary system commands — which includes data theft, configuration modification, backdoor installation, and potential lateral movement within the internal network.

LoadMaster software must be updated immediately to version LMOS 7.2.59.2, 7.2.54.8, or 7.2.48.10 (depending on the branch in use). Additionally, it is recommended to restrict access to the management interface only to trusted IP addresses and to isolate the management interface from the production network.

Progress LoadMaster — versions indicated in the manufacturer's references (patch available in LMOS 7.2.59.2, 7.2.54.8, and 7.2.48.10 versions according to the manufacturer's documentation)

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.