← CVE Radar
CVE-2024-1212LoadMaster Pre-Authenticated OS Command Injection
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
10.0 CRITICALEPSS 95.38%⚡ Known Exploited (CISA KEV)NVD: Analyzed
Overview
Severity
| Score | Severity | Version | Vector String |
|---|---|---|---|
| 10.0 | CRITICAL | 3.1ProgressSoftware (CNA) | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| 9.8 | CRITICAL | 3.1NVD | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
CISA required action
⚡ Known exploited · remediation due Dec 9, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Details
- CVE ID
- CVE-2024-1212
- Status
- Analyzed
- Assigner (CNA)
- ProgressSoftware
- Published
- Feb 21, 2024
- Last modified
- 2026-07-13 19:49 UTC
- Weaknesses
- CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Affected Products
As published by the CNA in the CVE record.
Progress SoftwareLoadMaster3 version ranges
- 7.2.48.1 before 7.2.48.10
- 7.2.54.0 before 7.2.54.8
- 7.2.55.0 before 7.2.59.2
References
- freeloadbalancer.com https://freeloadbalancer.com/
- kemptechnologies.com https://kemptechnologies.com/
- support.kemptechnologies.com https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212
- support.kemptechnologies.com https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212
- cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1212