10

CVE-2024-1212: Progress Kemp LoadMaster OS Command Injection Vulnerability

CVSS: 10.0v3.1CriticalKEVAnalyzed
Published 21-02-2024Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2024-1212 is a critical (CVSS 10.0) OS Command Injection vulnerability in Progress Kemp LoadMaster. It is known to be exploited: CISA lists it, first on 18-11-2024. EPSS estimates a 95.39% chance of exploitation in the next 30 days, higher than 99.8% of scored vulnerabilities. 2 public exploits are recorded.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
10.0/10
010
Critical · v3.1 (CVE.org)
EPSS score
95.39%
0%100%
Critical · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits2metasploit

Timeline

  1. 21-02-2024
    PublishedVulnerability first disclosed.
  2. 18-11-2024
    Added to CISA KEVProgress Kemp LoadMaster OS Command Injection Vulnerability
  3. 09-12-2024
    CISA remediation dueApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

CVSS metrics

2 scores · 2 sources · 1 version

EPSS trend

Probability

95.39%

Chance of exploitation in the next 30 days

Percentile

100%

Versus all other CVEs

30-day change

0.00 pp

From 95.39% on 20-09-2026

20-09-202620-10-2026
EPSS score
95.39%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
18-11-2024
Federal due date
09-12-2024

CISA required action

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. community.progress.com/s/article/Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212 nvd.nist.gov/vuln/detail/CVE-2024-1212

Public exploits

2 found
  • MetasploitMetasploitremoteVerified

    Kemp LoadMaster Unauthenticated Command Injection

    exploit/linux/http/progress_kemp_loadmaster_unauth_cmd_injection

    Maturity: weaponized

  • MetasploitMetasploitremoteVerified

    Kemp LoadMaster Local sudo privilege escalation

    exploit/linux/local/progress_kemp_loadmaster_sudo_privesc_2024

    Maturity: weaponized

Weaknesses

CWE · root cause

Affected systems

Progress1 product
  • loadmaster≥ 7.2.48.1, < 7.2.48.10 | ≥ 7.2.54.0, < 7.2.54.8 | ≥ 7.2.55.0, < 7.2.59.2
Progress software1 product
  • loadmaster≥ 7.2.48.1, < 7.2.48.10 | ≥ 7.2.54.0, < 7.2.54.8 | ≥ 7.2.55.0, < 7.2.59.2

2 vendors · 2 products

References

5 links