CVE-2024-1212: Progress Kemp LoadMaster unauthenticated OS command injection, actively exploited
The short version: CVE-2024-1212 lets an unauthenticated, remote attacker reach the Progress Kemp LoadMaster management interface and execute arbitrary system commands — a specially crafted request to the /access endpoint is passed unchecked into a system call, potentially escalating to root. It's confirmed exploited and in CISA's KEV catalog. LoadMaster is a load balancer that sits in front of applications, so control of it reaches far. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | Critical — in practice and on paper |
| CVSS v3.1 (NVD) | 9.8 — Critical · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (Progress, CNA) | 10.0 — Critical |
| EPSS | ~95.39% · 99.86th percentile (2026-07-17) |
| In CISA KEV? | Yes — remediate by 2024-12-05 |
| Known exploited? | Yes — CISA confirmed active exploitation |
| Vulnerability type | CWE-78 OS command injection → unauthenticated arbitrary command execution (potential root) |
| Requires authenticated session? | No — pre-authentication |
| Affected | LoadMaster 7.2.48.1–7.2.48.10, 7.2.54.0–7.2.54.8, 7.2.55.0–7.2.59.2 (versions before the fixes below) |
| Fixed in | LoadMaster 7.2.48.10 · 7.2.54.8 · 7.2.59.2 (and later) |
What you need to know
Progress Kemp LoadMaster is an application delivery controller (load balancer). CVE-2024-1212 is an OS command injection reachable through the LoadMaster management interface with no authentication: a crafted request to the /access endpoint bypasses restrictions, and attacker-controlled input reaches a system() call — letting the attacker run commands on the device, potentially escalating to root for full control.
Why it belongs at the top of the queue:
- It's unauthenticated and network-reachable. No credential, no chain.
- It's a delivery controller. LoadMaster fronts applications and often carries administrative reach — compromise extends well beyond one host.
- It's confirmed exploited and in KEV, with a very high EPSS and public analysis of the mechanism.
How serious we see it
Critical — the score isn't hyperbole here.
Unauthenticated command execution on an internet-reachable application delivery controller, confirmed exploited and KEV-listed, is top-of-queue. The bounded, reassuring part is that it's narrow and fixable: it affects specific LoadMaster builds, the fixes have been available since early 2024, and keeping the management interface off the public internet removes the exposure.
Recommendations
Straight from Progress's guidance and CISA:
- Patch now. Upgrade to LoadMaster 7.2.48.10 / 7.2.54.8 / 7.2.59.2 or later.
- Get the management interface off the internet. Restrict it to trusted networks or a VPN.
- Hunt. Review logs for unexpected requests to
/accessand for signs of command execution. - If compromised, respond fully. Rebuild where warranted and rotate all credentials and secrets on the device.
- Confirm your exposure first. Verify whether an affected LoadMaster management interface is reachable at all.
How BreachRisk sees it
BreachRisk discovers internet-facing Progress Kemp LoadMaster interfaces from little more than your domain, fingerprints the product and version, and flags exposure tied to KEV-listed, actively exploited vulnerabilities like this one — surfaced at the top because it's in KEV.
That continuous, outside-in view is the point: when an unauthenticated RCE in an edge appliance breaks, the exposed device is already mapped, so you can go straight to patch-and-verify.