Remote Attackers Can Execute Arbitrary System Commands via LoadMaster Management Interface
CVE-2024-1212

9.8CRITICAL

Key Information:

Vendor: Progress Software
Status: Loadmaster
Vendor: CVE Published:; 21 February 2024

Badges

🥇 Trended No. 1📈 Trended📈 Score: 6,880👾 Exploit Exists🟡 Public PoC🟣 EPSS 93%🦅 CISA Reported📰 News Worthy

What is CVE-2024-1212?

CVE-2024-1212 is a significant vulnerability found in the LoadMaster management interface developed by Progress Software. This vulnerability permits unauthorized remote attackers to exploit the LoadMaster system, enabling them to execute arbitrary system commands. As LoadMaster is primarily used for load balancing and application delivery, this flaw poses a substantial risk to organizations relying on the product for their operations. If exploited, this vulnerability can lead to severe disruptions, unauthorized access to sensitive data, and substantial reputational damage.

Technical Details

The vulnerability exists due to improper access controls within the LoadMaster management interface, allowing unauthenticated users to gain entry to the system. By exploiting this flaw, attackers can execute arbitrary commands on the affected system, thus gaining control over critical functions and processes. This vulnerability may arise from misconfigurations or oversights in the security implementations of the LoadMaster software, highlighting a concerning area in which server management best practices must be observed rigorously.

Impact of the Vulnerability

Unauthorized System Access: Attackers can gain unrestricted access to the management interface of the LoadMaster, allowing them to perform unauthorized actions that could compromise the integrity of the entire system.
Potential for Remote Code Execution: The ability to execute arbitrary commands can lead to full system compromise, where an attacker can manipulate configurations, deploy malware, or further infiltrate the network.
Data Breaches and Sensitive Information Exposure: By exploiting this vulnerability, attackers may access confidential data stored within the LoadMaster or within connected applications, resulting in severe data loss and potential legal repercussions for organizations due to data protection regulations.

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Affected Version(s)

LoadMaster Linux 7.2.48.1

LoadMaster Linux 7.2.48.1 < 7.2.48.10

LoadMaster Linux 7.2.54.0 < 7.2.54.8

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-1212
Created by Chocapikk

News Articles

GBHackers News

CVE-2024-1212

CISA Warns Kemp LoadMaster OS Command Injection Vulnerability Exploited in Attacks

CISA issued an urgent security advisory warning organizations about an active exploitation of a vulnerability in Progress Kemp LoadMaster.

2 months ago

SecurityWeek

CVE-2024-1212

CISA Warns of Progress Kemp LoadMaster Vulnerability Exploitation

CISA is warning organizations that CVE-2024-1212, a Kemp LoadMaster OS command injection vulnerability, is being exploited in attacks.

2 months ago

BleepingComputer

CVE-2024-1212 CVE-2024-7591

CISA tags Progress Kemp LoadMaster flaw as exploited in attacks

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added three new flaws in its Known Exploited Vulnerabilities (KEV) catalog, including a critical OS command injection impacting Progress Kemp LoadMaster.

2 months ago