CISA Warns Kemp LoadMaster OS Command Injection Vulnerability Exploited in Attacks

The Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent security advisory warning organizations about an active exploitation of a critical vulnerability in Progress Kemp LoadMaster, a popular load balancing and application delivery solution.

Designated as CVE-2024-1212, the vulnerability allows remote, unauthenticated attackers to execute arbitrary commands on affected systems, posing a severe threat to organizations relying on the product for network management.

CVE-2024-1212: Progress Kemp LoadMaster OS Command Injection Vulnerability

According to CISA, the vulnerability, which is related to CWE-78 (Improper Neutralization of Special Elements used in an OS Command), stems from improper input sanitization in the LoadMaster management interface.

This flaw enables attackers to inject operating system commands that can be executed with elevated privileges.

Maximizing Cybersecurity ROI: Expert Tips for SME & MSP Leaders – Attend Free Webinar

Given the nature of the vulnerability, attackers can take full control of compromised systems, potentially leading to further attacks, data breaches, or service disruptions.

The vulnerability is particularly concerning as it does not require authentication, meaning that even attackers without valid credentials can exploit the flaw remotely.

Access to the system through this vulnerability could allow the execution of arbitrary commands, including file manipulation, system reconfiguration, and the installation of malicious software.

While it remains unknown whether CVE-2024-1212 has been used in ransomware campaigns, CISA emphasizes that the vulnerability is being actively exploited in the wild.

The agency has urged organizations to prioritize remediation measures immediately to avoid potential compromises.

CISA strongly advises all organizations using Progress Kemp LoadMaster to assess their systems and apply available vendor patches or mitigations.

If a patch or workaround is not available, organizations should consider discontinuing the use of the product until a fix can be applied.

Administrators are encouraged to consult the vendor’s official documentation for detailed instructions on securing their systems.

Are you from SOC/DFIR Teams? – Analyse Malware Files & Links with ANY.RUN -> Try for Free