The Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent security advisory warning organizations about an active exploitation of a critical vulnerability in Progress Kemp LoadMaster, a popular load balancing and application delivery solution.
Designated as CVE-2024-1212, the vulnerability allows remote, unauthenticated attackers to execute arbitrary commands on affected systems, posing a severe threat to organizations relying on the product for network management.
According to CISA, the vulnerability, which is related to CWE-78 (Improper Neutralization of Special Elements used in an OS Command), stems from improper input sanitization in the LoadMaster management interface.
This flaw enables attackers to inject operating system commands that can be executed with elevated privileges.
Maximizing Cybersecurity ROI: Expert Tips for SME & MSP Leaders – Attend Free Webinar
Given the nature of the vulnerability, attackers can take full control of compromised systems, potentially leading to further attacks, data breaches, or service disruptions.
The vulnerability is particularly concerning as it does not require authentication, meaning that even attackers without valid credentials can exploit the flaw remotely.
Access to the system through this vulnerability could allow the execution of arbitrary commands, including file manipulation, system reconfiguration, and the installation of malicious software.
While it remains unknown whether CVE-2024-1212 has been used in ransomware campaigns, CISA emphasizes that the vulnerability is being actively exploited in the wild.
The agency has urged organizations to prioritize remediation measures immediately to avoid potential compromises.
CISA strongly advises all organizations using Progress Kemp LoadMaster to assess their systems and apply available vendor patches or mitigations.
If a patch or workaround is not available, organizations should consider discontinuing the use of the product until a fix can be applied.
Administrators are encouraged to consult the vendor’s official documentation for detailed instructions on securing their systems.
Are you from SOC/DFIR Teams? – Analyse Malware Files & Links with ANY.RUN -> Try for Free
A Türkiye-affiliated espionage threat actor, tracked by Microsoft Threat Intelligence as Marbled Dust (also known…
Cobalt Strike has announced the release of version 4.11.1, an out-of-band update addressing several critical…
Apple released critical security updates for macOS Sequoia 15.5 on May 12, 2025, addressing over…
Sophos Managed Detection and Response (MDR) in September 2024, the notorious Lumma Stealer malware has…
Cybercriminals have unleashed a new malware campaign using fake AI video generation platforms as a…
The North Korean state-sponsored Advanced Persistent Threat (APT) group Kimsuky, also known as “Black Banshee,”…
