CISA tags Progress Kemp LoadMaster flaw as exploited in attacks

The U.S. Cybersecurity & Infrastructure Security Agency (CISA) has added three new flaws in its Known Exploited Vulnerabilities (KEV) catalog, including a critical OS command injection impacting Progress Kemp LoadMaster.

The flaw, discovered by Rhino Security Labs and tracked as CVE-2024-1212, was addressed via an update released on February 21, 2024. However, this is the first report of it being under active exploitation in the wild.

“Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution,” reads the flaw’s description.

CVE-2024-1212 (CVSS v3.1 score: 10.0, “critical”) impacts LoadMaster versions 7.2.48.1 before 7.2.48.10, 7.2.54.0 before 7.2.54.8, and 7.2.55.0 before 7.2.59.2.

LoadMaster is an application delivery controller (ADC) and load-balancing solution used by large organizations to optimize app performance, manage network traffic, and ensure high service availability.

CISA orders federal organizations using the product to apply the available updates and mitigations until December 9, 2024, or stop using it.

No details about the active exploitation activity have been published at this time, and the status of its exploitation in ransomware campaigns is marked as unknown.

The other two flaws CISA added to KEV are CVE-2024-0012 and CVE-2024-9474, authentication bypass and OS command injection flaws respectively, impacting Palo Alto Networks PAN-OS Management Interface.

Progress Software recently fixed another max severity flaw in LoadMaster products that allows remote attackers to execute arbitrary commands on the device.

Identified as CVE-2024-7591, the flaw is categorized as an improper input validation problem allowing an unauthenticated, remote attacker to access LoadMaster’s management interface using a specially crafted HTTP request.

CVE-2024-7591 impacts LoadMaster version 7.2.60.0 and all previous versions, as well as MT Hypervisor version 7.1.35.11 and all prior releases.

That said, system administrators looking to upgrade to a safe version should move to a release that addresses both maximum severity flaws in LoadMaster, even if active exploitation for CVE-2024-7591 has not been observed yet.