Cyber Security News

CISA Warns Kemp LoadMaster OS Command Injection Vulnerability Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent security advisory warning organizations about an active exploitation of a critical vulnerability in Progress Kemp LoadMaster, a popular load balancing and application delivery solution.

Designated as CVE-2024-1212, the vulnerability allows remote, unauthenticated attackers to execute arbitrary commands on affected systems, posing a severe threat to organizations relying on the product for network management.

CVE-2024-1212: Progress Kemp LoadMaster OS Command Injection Vulnerability

According to CISA, the vulnerability, which is related to CWE-78 (Improper Neutralization of Special Elements used in an OS Command), stems from improper input sanitization in the LoadMaster management interface.

This flaw enables attackers to inject operating system commands that can be executed with elevated privileges.

Maximizing Cybersecurity ROI: Expert Tips for SME & MSP Leaders – Attend Free Webinar

Given the nature of the vulnerability, attackers can take full control of compromised systems, potentially leading to further attacks, data breaches, or service disruptions.

The vulnerability is particularly concerning as it does not require authentication, meaning that even attackers without valid credentials can exploit the flaw remotely.

Access to the system through this vulnerability could allow the execution of arbitrary commands, including file manipulation, system reconfiguration, and the installation of malicious software.

While it remains unknown whether CVE-2024-1212 has been used in ransomware campaigns, CISA emphasizes that the vulnerability is being actively exploited in the wild.

The agency has urged organizations to prioritize remediation measures immediately to avoid potential compromises.

CISA strongly advises all organizations using Progress Kemp LoadMaster to assess their systems and apply available vendor patches or mitigations.

If a patch or workaround is not available, organizations should consider discontinuing the use of the product until a fix can be applied.

Administrators are encouraged to consult the vendor’s official documentation for detailed instructions on securing their systems.

Are you from SOC/DFIR Teams? – Analyse Malware Files & Links with ANY.RUN -> Try for Free

Divya

Divya is a Senior Journalist at GBhackers covering Cyber Attacks, Threats, Breaches, Vulnerabilities and other happenings in the cyber world.

Recent Posts

Hackers Claim WooCommerce Breach Exposing 4.4 Million Customer Records

A hacker operating under the alias “Satanic” has claimed responsibility for a massive data breach…

2 minutes ago

TP-Link Smart Hub Flaw Exposes Users’ Wi-Fi Credentials

A critical vulnerability has been discovered in TP-Link’s Smart Hub, potentially exposing users’ Wi-Fi credentials…

16 minutes ago

APT32 Turns GitHub into a Weapon Against Security Teams and Enterprise Networks

Southeast Asian Advanced Persistent Threat (APT) group OceanLotus, also known as APT32, has been identified…

3 hours ago

AkiraBot Floods 80,000 Sites After Outsmarting CAPTCHAs and Slipping Past Network Defenses

AkiraBot, identified by SentinelLABS, represents a sophisticated spam bot framework that targets website chats and…

3 hours ago

Microsoft Identity Web Flaw Exposes Sensitive Client Secrets and Certificates

A new vulnerability has been discovered in the Microsoft.Identity.Web NuGet package under specific conditions, potentially…

3 hours ago

CatB Ransomware Abuses Microsoft Distributed Transaction Coordinator for Stealthy Payload Execution

The cybersecurity realm has encountered a formidable adversary with the emergence of CatB ransomware, also…

3 hours ago