CVE-2024-1212: Progress Kemp LoadMaster OS Command Injection Vulnerability
First published: Wed Feb 21 2024(Updated: )
Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.
Credit: security@progress.com security@progress.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Progress Kemp LoadMaster | ||
| Progress Loadmaster | >=7.2.48.1<7.2.48.10 | |
| Progress Loadmaster | >=7.2.54.0<7.2.54.8 | |
| Progress Loadmaster | >=7.2.55.0<7.2.59.2 |
Remedy
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://community.progress.com/s/article/Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212
- https://nvd.nist.gov/vuln/detail/CVE-2024-1212
- https://freeloadbalancer.com/
- https://kemptechnologies.com/
- https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212
- https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212
- https://www.bleepingcomputer.com/news/security/cisa-tags-progress-kemp-loadmaster-flaw-as-exploited-in-attacks/
- agent/type
- agent/first-publish-date
- agent/remedy
- agent/references
- agent/description
- exploited/true
- collector/cisa-known-exploited
- source/CISA
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- collector/nvd-cve
- source/NVD
- agent/author
- collector/mitre-cve
- source/MITRE
- agent/title
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/event
- collector/nvd-api
- agent/softwarecombine
- agent/tags
- collector/bleeping-computer
- source/BleepingComputer
- alias/CVE-2024-1212
- alias/CVE-2024-0012
- alias/CVE-2024-9474
- alias/CVE-2024-7591
- vendor/progress
- canonical/progress kemp loadmaster
- canonical/progress loadmaster
- version/progress loadmaster/7.2.48.1
- version/progress loadmaster/7.2.54.0
- version/progress loadmaster/7.2.55.0