CVE-2024-1212

Progress Kemp LoadMaster OS Command Injection Vulnerability

Progress — Kemp LoadMaster

Added to KEV catalog: 18 November 2024
Federal remediation due date: 9 December 2024
Weakness classification (CWE): CWE-78

CISA Description

Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.

Required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes

https://community.progress.com/s/article/Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1212

View on NVD View on MITRE CVE View full CISA catalog

More Progress Vulnerabilities

CVE-2024-4885

Progress WhatsUp Gold Path Traversal Vulnerability

CVE-2024-6670

Progress WhatsUp Gold SQL Injection Vulnerability

CVE-2024-4358

Progress Telerik Report Server Authentication Bypass by Spoofing Vulnerability

CVE-2023-40044

Progress WS_FTP Server Deserialization of Untrusted Data Vulnerability

CVE-2023-34362

Progress MOVEit Transfer SQL Injection Vulnerability

Confirm Your Exposure

Is this vulnerability present in your environment?

CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.

Explore VAPT Services