Skip to main content
IMMUNITYSEC

CVE-2024-1212

LoadMaster Pre-Authenticated OS Command Injection

10.0
CRITICAL
CVSS 3.1
EPSS 95.4% · 100th pctCISA KEV · Exploited in the wildCWE-78
2024-02-21•Updated 2025-10-21•KEV 2024-11-18
CISA Known Exploited Vulnerabilities

Progress Kemp LoadMaster OS Command Injection Vulnerability is confirmed as actively exploited and is listed in the CISA KEV catalog.

Added to KEV
2024-11-18
Remediation due
2024-12-09

Required action
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

CISA notes
https://community.progress.com/s/article/Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212 ; https://nvd.nist.gov/vuln/detail/CVE-2024-1212

Description

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

Severity

CVSS 3.1 · CNA10 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
SSVC · CISA-ADP
Exploitationactive
Automatableyes
Technical impacttotal

Affected Products

VendorProductAffected versions
Progress SoftwareLoadMaster
7.2.48.1 to <7.2.48.10
7.2.54.0 to <7.2.54.8
7.2.55.0 to <7.2.59.2

References

4 Links

Record Details

Published
2024-02-21
Last updated
2025-10-21
Assigner (CNA)
ProgressSoftware
Credited to
Rhino Security Labs

More from Progress Software

CVE-2026-80379.6

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAF

Related Tool Categories

Tool categories that test for or protect against this vulnerability class.

CVE record data © The MITRE Corporation, used under the CVE Terms of Use. Exploited-in-the-wild data from the CISA Known Exploited Vulnerabilities catalog (CC0). Exploit prediction scores by FIRST EPSS (first.org/epss). This site is not endorsed or certified by MITRE, NVD, CISA, or FIRST.