CVE-2024-2389: Progress Flowmon unauthenticated command injection, root-level RCE
The short version: Progress Flowmon — a network performance and security monitoring product — has an OS command-injection flaw (CVE-2024-2389) that lets an unauthenticated attacker reach the system through the Flowmon management interface and execute arbitrary commands. The vendor scores it a perfect 10.0 and a public exploit exists. It is not in CISA's KEV catalog, but unauthenticated RCE on a monitoring appliance is patch-now. Steady hands — but move.
At a glance
| Fact | Detail |
|---|---|
| Our severity take | High — unauthenticated, network-reachable command execution on a monitoring appliance |
| CVSS v3.1 (NVD) | 9.8 — Critical (primary) · AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| CVSS (vendor) | 10.0 — Critical · AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H |
| EPSS | 93.90% · 99.83th percentile (2026-07-17) |
| In CISA KEV? | No |
| Known exploited? | Not listed in CISA KEV; a public exploit exists |
| Vulnerability type | CWE-78 OS command injection → unauthenticated remote code execution |
| Requires authenticated session? | No — pre-authentication |
| Affected | Progress Flowmon before 11.1.14 and before 12.3.5 |
| Fixed in | 11.1.14 and 12.3.5 |
What you need to know
CVE-2024-2389 is an OS command injection reachable through the Flowmon management interface. An unauthenticated attacker sends a crafted request that the appliance passes into a system command without proper sanitization, yielding arbitrary command execution — and the vendor's scope-changing 10.0 vector reflects that the impact reaches beyond the vulnerable component.
Why it belongs near the top of the queue:
- It's pre-authentication. No credential, no chain — the management interface is the whole attack surface.
- It's a security/monitoring appliance. These sit with broad visibility into network traffic; code execution there is a serious foothold.
- A public exploit exists, reflected in the very high EPSS — though, as of this writing, it is not in CISA KEV.
How serious we see it
High — the mechanics are Critical-grade; we hold at High on exploitation status.
Unauthenticated command execution on a monitoring appliance is exactly the kind of exposure that turns one internet-facing box into deep network access, and the 10.0/9.8 scores describe the mechanism honestly. We land at High rather than Critical because it is not KEV-listed and we have no confirmation of mass in-the-wild exploitation — but with a public exploit and a near-top EPSS, that gap can close fast, so don't wait for it. The reassuring part: it affects specific versions, fixes are published, and confirming exposure is quick.
Recommendations
Straight from Progress/Kemp's advisory:
- Patch now. Upgrade Flowmon to 11.1.14 or 12.3.5 (or later).
- Harden exposure. Keep the Flowmon management interface off the public internet; restrict it to trusted networks or a VPN.
- Hunt if it was exposed. Review management-interface logs for anomalous requests and unexpected process execution before your patch date.
- If you find indicators, respond. Isolate the appliance, rotate credentials and keys, and investigate for lateral movement.
- Confirm your exposure first. Verify whether any Flowmon management interface is reachable from the internet, and which version.
How BreachRisk sees it
BreachRisk discovers internet-facing Flowmon management interfaces from little more than your domain, fingerprints the product and version, and flags exposure tied to this CVE. For a version-based appliance flaw we detect and flag the exposure; we don't exploit it. That outside-in view answers the first question — do we have an exposed, affected appliance? — so an internet-reachable monitoring box gets patched before it becomes an attacker's vantage point.