Critical OS Command Injection in Progress Kemp LoadMaster (CVE‑2024‑1212) Threatens Load‑Balancer Management
What It Is
Progress Kemp LoadMaster’s web‑based management interface contains an OS command‑injection flaw. An unauthenticated, remote adversary can inject arbitrary operating‑system commands and achieve full system compromise. The vulnerability is catalogued by CISA’s Known Exploited Vulnerabilities (KEV) list and assigned a Critical severity rating.
Exploitability
The flaw is exploitable without credentials over the network. While a public proof‑of‑concept has not been released, the CVE’s inclusion in the KEV program indicates active exploitation in the wild or a high likelihood thereof. CVSS v3.1 base score is reported as 9.8 (Critical).
Affected Products
- Vendor: Progress
- Product: Kemp LoadMaster (all supported versions that expose the management UI)
Why It Matters for Compliance & Audit Readiness
Control‑assurance programs rely on demonstrable due‑diligence around third‑party network appliances. An unauthenticated command‑injection bypasses traditional access‑control safeguards, eroding the integrity of the “Access Control” and “Vendor Management” domains in frameworks such as NIST CSF and ISO 27001. Evidence of timely patching, configuration hardening, and continuous monitoring of management‑plane traffic provides a defensible audit trail and satisfies regulator expectations for risk‑based vendor oversight.
Recommended Actions
- Inventory & Prioritise: Identify every LoadMaster instance in scope and map it to your asset register.
- Patch Immediately: Apply the vendor‑released security update (or interim mitigation) as soon as it is available.
- Restrict Management Access: Enforce network‑level segmentation and multi‑factor authentication for the management UI.
- Enable Logging & Alerting: Capture command‑execution logs and integrate them with a SIEM for real‑time anomaly detection.
- Document Controls: Update your vendor‑risk register and control‑mapping artifacts to reflect the remediation status and evidence of remediation.
Source: https://nvd.nist.gov/vuln/detail/CVE-2024-1212