Progress · Kemp LoadMaster
CVE-2024-1212
LoadMaster Pre-Authenticated OS Command Injection
What it is
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
CISA: Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.
What to do
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Deadline for US federal agencies: December 9, 2024
More exploited flaws from Progress
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Aug 7, 2026 | Command Injection | LoadMaster | Critical 9.6 | 99.8% |
| Mar 3, 2025 | Path Traversal | WhatsUp Gold | Critical 9.8 | 99.3% |
| Sep 16, 2024 | SQL Injection | WhatsUp Gold | Critical 9.8 | 93% |
| Jun 13, 2024 | Authentication Bypass by Spoofing | Telerik Report Server | Critical 9.8 | 97% |
| Oct 5, 2023 | Deserialization of Untrusted Data | WS_FTP Server | Critical 10.0 | 90% |
| Jun 2, 2023 | SQL Injection | MOVEit Transfer | Critical 9.8 | 99.9% |
| Nov 3, 2021 | Telerik UI for ASP.NET AJAX and Sitefinity Cryptographic Weakness | ASP.NET AJAX and Sitefinity | Critical 9.8 | 75% |
| Nov 3, 2021 | Deserialization of Untrusted Data | Telerik UI for ASP.NET AJAX | Critical 9.8 | 99.7% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.