by Kastro
Paper/Archive/CVE-2024-1212

CVE-2024-1212

Progress Software LoadMaster — LoadMaster Pre-Authenticated OS Command Injection

KEV · due 9 DecEPSS 95%public exploitSSVC actCVSS 10.0
critical.is priorityof 100
100
CVSS 10.0 (CNA)10.0 / 10 × 3030.0In CISA KEV+3030.0EPSS percentile 99.9.999 × 2020.0Exploit: SSVC active+1010.0SSVC exploitation: active+1010.0
Description · from the CVE record

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

Affected

ProductAffectedFixed inSource
LoadMaster7.2.48.1 – < 7.2.48.107.2.48.10CNA
LoadMaster7.2.54.0 – < 7.2.54.87.2.54.8CNA
LoadMaster7.2.55.0 – < 7.2.59.27.2.59.2CNA
loadmaster7.2.48.1 – < 7.2.48.107.2.48.10CISA-ADP
loadmaster7.2.54.0 – < 7.2.54.87.2.54.8CISA-ADP
loadmaster7.2.55.0 – < 7.2.59.27.2.59.2CISA-ADP
loadmaster7.2.48.1 – < 7.2.48.107.2.48.10CISA-ADP
loadmaster7.2.54.0 – < 7.2.54.87.2.54.8CISA-ADP
loadmaster7.2.55.0 – < 7.2.59.27.2.59.2CISA-ADP
loadmaster7.2.48.1 – < 7.2.48.107.2.48.10CISA-ADP
loadmaster7.2.54.0 – < 7.2.54.87.2.54.8CISA-ADP
loadmaster7.2.55.0 – < 7.2.59.27.2.59.2CISA-ADP

Scores by source

ProgressSoftware (CNA)10.0CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CISA ADPSSVCExploitation: active · Automatable: yes · Technical impact: total

References

refkemptechnologies.comreffreeloadbalancer.comadvisorysupport.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212advisorysupport.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212refcisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1212kevcisa.gov/known-exploited-vulnerabilities-catalog