CVE-2024-1212criticalunder attackCWE-78

CVE-2024-1212: critical vulnerability in Progress Software LoadMaster

LoadMaster Pre-Authenticated OS Command Injection

Published · Updated

Follow this CVE+ Monitor LoadMaster+ Monitor Kemp LoadMaster

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

100Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 10epss 95%
from disclosure to weapon27 days
Published on NVDFeb 21
1st PoC+27d
metasploit+27d
CISA KEV+271d
Action required by CISAfederal deadline: 2024-12-09

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

In short

Attackers can remotely execute arbitrary commands on a LoadMaster system without needing to log in. This allows complete control over the affected device and poses an immediate critical risk.

Technical detail

CWE-78 OS command injection in LoadMaster's management interface allows unauthenticated remote attackers to inject and execute arbitrary system commands. The vulnerability requires network access to the management interface but no prior authentication, resulting in full system compromise.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Affected products
Progress Software · LoadMaster
⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.
Related CVEs — Progress Software LoadMaster

In the same product, most dangerous first.

CVE-2026-8037CRITICALOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAFEPSS 99.8%KEVCVE-2024-2448HIGHLoadMaster Command Injection VulnerabilityEPSS 55.4%CVE-2025-13447HIGHOS Command Injection Remote Code Execution Vulnerability in Progress LoadMasterEPSS 27.2%CVE-2025-13444HIGHOS Command Injection Remote Code Execution Vulnerability in Progress LoadMasterEPSS 27.2%CVE-2026-3518HIGHOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAFEPSS 16.9%CVE-2026-3517HIGHOS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster, ECS Connection Manager, Object Scale Connection Manager & MOVEit WAFEPSS 15.5%