CVE-2024-1212
Progress Kemp LoadMaster OS Command Injection Vulnerability
Description
CVE-2024-1212 is a critical vulnerability in Progress Kemp LoadMaster, a widely deployed application delivery controller and load balancer, that allows unauthenticated remote attackers to access the system through the management interface and execute arbitrary system commands. With the maximum possible CVSS v3.1 base score of 10.0, this vulnerability represents the highest severity rating achievable, indicating trivial exploitability with catastrophic impact. The vulnerability affects LoadMaster versions 7.2.48.1 through 7.2.48.10, 7.2.54.0 through 7.2.54.8, and 7.2.55.0 through 7.2.59.2. CISA has added CVE-2024-1212 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 9, 2024, and its EPSS score of 94.31% at the 99.9th percentile confirms near-certain active exploitation.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| progress | loadmaster | >= 7.2.48.1, < 7.2.48.10; >= 7.2.54.0, < 7.2.54.8; >= 7.2.55.0, < 7.2.59.2 |
Multiple CVSS Assessments
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://freeloadbalancer.com/(Product)
- https://kemptechnologies.com/(Product)
- https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212(Not Applicable)
- https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212(Release Notes)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1212(US Government Resource)
Weakness Type
Unauthenticated Remote Command Execution via Management Interface
CVE-2024-1212 is an unauthenticated remote command execution vulnerability in the Progress Kemp LoadMaster management interface. The weakness enables remote attackers to bypass all authentication controls and execute arbitrary operating system commands on the underlying system. The management interface fails to properly authenticate and authorize incoming requests for certain operations, allowing an attacker to send crafted requests that are processed as system commands without any credential validation. This combination of authentication bypass and command injection in a network-facing management interface represents one of the most dangerous vulnerability classes, as it provides immediate, unauthenticated access to the underlying operating system.
Impact Analysis
The impact of CVE-2024-1212 is the most severe possible, achieving the maximum CVSS base score of 10.0 with a changed scope (S:C), meaning exploitation of the LoadMaster management interface can affect resources beyond the vulnerable component itself. Confidentiality is completely compromised because arbitrary command execution provides the attacker with full access to all data on the LoadMaster system, including SSL/TLS certificates and private keys used for traffic encryption, load balancing configurations containing backend server addresses and credentials, health check configurations, and any cached application data passing through the load balancer.
Integrity faces total compromise as command execution allows the attacker to modify any aspect of the system, including altering traffic routing rules to redirect application traffic to malicious servers, injecting malicious content into load-balanced traffic streams, modifying SSL/TLS configurations to enable traffic interception, and installing persistent backdoors.
Availability is critically at risk because the attacker can shut down the LoadMaster, corrupt its configuration, disrupt all load-balanced services, or use the compromised device to launch denial-of-service attacks against backend servers. The changed scope (S:C) elevates this vulnerability further because a compromised load balancer has a privileged position in the network, able to observe, modify, and disrupt traffic for all applications it serves. The EPSS score of 94.31% at the 99.9th percentile reflects near-certain exploitation in the wild. While the ransomware association is listed as unknown, the level of system access gained makes this vulnerability highly attractive to all classes of threat actors.
Exploit Maturity
CVE-2024-1212 demonstrates the highest level of exploit maturity, confirmed by its inclusion in CISA's Known Exploited Vulnerabilities catalog and an EPSS score of 94.31% at the 99.9th percentile, placing it among the most actively exploited vulnerabilities globally. The maximum CVSS score of 10.0 combined with the unauthenticated, network-accessible nature of the vulnerability makes it an extremely attractive target for automated scanning and exploitation.
Progress has published security advisories and release notes for the patched versions (Release Notice), and the vulnerability details have been documented in the Kemp LoadMaster Security Vulnerability advisory. While CISA's ransomware classification is listed as unknown, the combination of unauthenticated access, command execution capabilities, and the load balancer's strategic network position makes this an ideal initial access vector for both financially motivated and state-sponsored threat actors.
Remediation
-
Upgrade LoadMaster firmware immediately. Apply the patched firmware versions: LoadMaster 7.2.48.10 for the 7.2.48.x branch, 7.2.54.8 for the 7.2.54.x branch, and 7.2.59.2 for the 7.2.55.x through 7.2.59.x branch. Refer to the Progress release notice for detailed upgrade instructions and compatibility information.
-
Restrict management interface access immediately. As the highest-priority compensating control, ensure the LoadMaster management interface is not accessible from the internet or untrusted networks. Implement firewall rules to limit management access to a dedicated management VLAN or specific trusted IP addresses. This single step prevents the most dangerous remote exploitation scenario.
-
Conduct forensic analysis on exposed systems. Any LoadMaster instance with a management interface accessible from untrusted networks while running a vulnerable firmware version must be treated as potentially compromised. Examine system logs for unusual commands, unauthorized configuration changes, and unexpected network connections. Check for persistent backdoors, modified configurations, and unauthorized SSL/TLS certificate changes.
-
Rotate all certificates and credentials. After patching, regenerate all SSL/TLS certificates and private keys stored on the LoadMaster, change all administrative credentials, and rotate any backend server credentials that may have been accessible through the load balancer configuration. Notify backend application teams to review their systems for signs of compromise through the load balancer.
-
Implement monitoring and detection. Deploy network monitoring to detect exploitation attempts against the LoadMaster management interface. Monitor for unusual management interface access patterns, unexpected outbound connections from the LoadMaster, and changes to load balancing configurations that were not authorized through change management processes.
Technical Details
CVE-2024-1212 is an unauthenticated remote command execution vulnerability in Progress Kemp LoadMaster with a CVSS v3.1 vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H, achieving the maximum base score of 10.0. This perfect score results from the combination of the most severe ratings across all metrics: network-accessible (AV:N), low complexity (AC:L), no privileges required (PR:N), no user interaction needed (UI:N), and a changed scope (S:C) with high impact across confidentiality, integrity, and availability.
The vulnerability resides in the LoadMaster management interface, which is the web-based administration portal used to configure load balancing rules, SSL/TLS offloading, health checks, and other application delivery features. The management interface fails to properly authenticate certain request types, allowing an unauthenticated remote attacker to submit requests that are processed with system-level privileges. The injected commands are executed directly by the operating system, granting the attacker the ability to run arbitrary programs, read and write files, and modify system configurations.
The changed scope (S:C) is significant because a compromised load balancer has visibility into and control over all traffic for the applications it serves. This means that exploitation of the LoadMaster does not just compromise the appliance itself but potentially exposes all backend applications, their data, and their users. The load balancer sits in a position to perform man-in-the-middle attacks on SSL/TLS traffic, redirect users to malicious servers, inject content into application responses, or exfiltrate data from any application passing through it. Affected versions include LoadMaster 7.2.48.1 through 7.2.48.9, 7.2.54.0 through 7.2.54.7, and 7.2.55.0 through 7.2.59.1.
Frequently Asked Questions
What is CVE-2024-1212?
CVE-2024-1212 is a critical vulnerability in Progress Kemp LoadMaster that allows unauthenticated remote attackers to execute arbitrary system commands through the management interface. It has the maximum possible CVSS score of 10.0, indicating trivial exploitability and catastrophic impact.
Why does CVE-2024-1212 have a CVSS score of 10.0?
The maximum score results from the combination of network accessibility, low attack complexity, no authentication requirement, no user interaction needed, and a changed scope that impacts resources beyond the LoadMaster itself. Every CVSS metric is at its most severe rating, reflecting that an unauthenticated internet-based attacker can fully compromise the system with a single request.
Which LoadMaster versions are affected?
LoadMaster versions 7.2.48.1 through 7.2.48.9, 7.2.54.0 through 7.2.54.7, and 7.2.55.0 through 7.2.59.1 are vulnerable. The patched versions are 7.2.48.10, 7.2.54.8, and 7.2.59.2 respectively.
What makes a compromised load balancer particularly dangerous?
A load balancer sits between users and backend applications, handling traffic routing and often SSL/TLS termination. A compromised load balancer can intercept encrypted traffic, redirect users to malicious servers, inject malicious content into application responses, and access credentials and data for all applications it serves.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.