CVE-2024-1212
LoadMaster Pre-Authenticated OS Command Injection
KEVCRITICAL 9.8EPSS 95.4%
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
- Affected
- Progress Software · LoadMaster
- CVSS v3.1 NVD
- 9.8 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H - CVSS v3.1 PROGRESS
- 10.0 CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - EPSS
- 95.39% chance of exploitation in the next 30 days, 100th percentile
- CISA KEV
- added 2024-11-18
- Nuclei
- critical · CWE-78
- Published
- 2024-02-21
- Updated
- 2025-10-21
Proof-of-concept exploits (4)
- Chocapikk/CVE-2024-121219★ · 2025-08-26
- YN1337/Kemp-LoadMaster-0★ · 2024-06-04
- alex14324/UCMDI1★ · 2024-09-10
- r0otk3r/CVE-2024-12120★ · 2025-07-12
Nuclei templates (1)
Metasploit modules (2)
- rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/progress_kemp_loadmas…
- rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/progress_kemp_loadma…
Security advisories
- https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS…
- https://freeloadbalancer.com
- https://kemptechnologies.com