A series of critical security vulnerabilities have been identified in Progress Software’s LoadMaster application, potentially allowing remote attackers to execute system commands or access sensitive files.
CVE-2024-56131, CVE-2024-56132, CVE-2024-56133, CVE-2024-56134, and CVE-2024-56135, affect all current versions of LoadMaster, including Multi-Tenant LoadMaster (MT) deployments, prompting an urgent patch advisory for users.
Progress Software has confirmed that no active exploits of these vulnerabilities have been reported. However, due to the risks posed, the company is strongly urging all users to update their LoadMaster implementations immediately.
To mitigate these flaws, Progress Software has implemented input sanitization measures to prevent the execution of arbitrary system commands and unauthorized file access.
Patch Release Details
Progress Software has released patched firmware versions to address these vulnerabilities. Users are encouraged to upgrade to the fixed versions immediately:
| Product | Affected Versions | Patched Versions | Release Date |
| LoadMaster | 7.2.55.0 to 7.2.60.1 | 7.2.61.0 (GA) | February 5, 2025 |
| LoadMaster | 7.2.49.0 to 7.2.54.12 | 7.2.54.13 (LTSF) | February 5, 2025 |
| LoadMaster | 7.2.48.12 and earlier versions | Upgrade to LTSF/GA | February 5, 2025 |
| Multi-Tenant LoadMaster | 7.1.35.12 and earlier versions | 7.1.35.13 (GA) | February 5, 2025 |
Multi-Tenant (MT) hypervisors and instantiated LoadMaster Virtual Network Functions (VNFs) are also vulnerable and require the same updates.
To secure their systems, customers should promptly download the latest firmware version from the LoadMaster Support Portal and follow the upgrade instructions detailed in the company’s Knowledge Base article.
Additionally, Progress Software recommends adhering to its security hardening guidelines for robust protection.
For further assistance, affected customers are advised to open a Technical Support case through the LoadMaster customer community.
This critical update underscores the importance of maintaining up-to-date security measures to prevent potential threats.
Are you from SOC/DFIR Team? - Join 500,000+ Researchers to Analyze Cyber Threats with ANY.RUN Sandbox - Try for Free
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…