{"id":"CVE-2024-1212","aliases":["EUVD-2024-16979","GHSA-8vv7-j7w3-28ww"],"status":"published","title":"LoadMaster Pre-Authenticated OS Command Injection","description":"Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.95388,"percentile":0.99869,"model":"v2026.06.15"},"facts":{"in_kev":true,"known_exploited":true,"public_exploit":true,"fix_available":false},"cwes":["CWE-78"],"published":"2024-02-21T17:39:12Z","modified":"2026-07-13T19:49:31Z","kev":{"date_added":"2024-11-18","due_date":"2024-12-09","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"exploitation":[{"source":"euvd","since":"2024-11-18"},{"source":"kev","since":"2024-11-18"}],"exploits":[{"source":"pocgithub","id":"Chocapikk/CVE-2024-1212","title":"Chocapikk/CVE-2024-1212","date":"2024-03-19","url":"https://github.com/Chocapikk/CVE-2024-1212"},{"source":"metasploit","id":"exploit/linux/http/progress_kemp_loadmaster_unauth_cmd_injection","title":"Kemp LoadMaster Unauthenticated Command Injection","type":"exploit","platform":"Linux,Unix","date":"2024-03-19","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/http/progress_kemp_loadmaster_unauth_cmd_injection"},{"source":"metasploit","id":"exploit/linux/local/progress_kemp_loadmaster_sudo_privesc_2024","title":"Kemp LoadMaster Local sudo privilege escalation","type":"exploit","platform":"Linux,Unix","date":"2024-03-19","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/local/progress_kemp_loadmaster_sudo_privesc_2024"},{"source":"pocgithub","id":"r0otk3r/CVE-2024-1212","title":"r0otk3r/CVE-2024-1212","date":"2025-07-12","url":"https://github.com/r0otk3r/CVE-2024-1212"},{"source":"nuclei","id":"CVE-2024-1212","title":"Progress Kemp LoadMaster - Command Injection","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2024/CVE-2024-1212.yaml"}],"products":[{"vendor":"kemptechnologies","product":"loadmaster"},{"vendor":"progress","product":"kemp loadmaster"},{"vendor":"progress","product":"loadmaster"},{"vendor":"progress software","product":"loadmaster"}],"references":[{"url":"https://kemptechnologies.com/","tags":["product","x_transferred","Product"]},{"url":"https://freeloadbalancer.com/","tags":["product","x_transferred","Product"]},{"url":"https://support.kemptechnologies.com/hc/en-us/articles/24325072850573-Release-Notice-LMOS-7-2-59-2-7-2-54-8-7-2-48-10-CVE-2024-1212","tags":["vendor-advisory","x_transferred","Release Notes"]},{"url":"https://support.kemptechnologies.com/hc/en-us/articles/23878931058445-LoadMaster-Security-Vulnerability-CVE-2024-1212","tags":["vendor-advisory","x_transferred","Not Applicable"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-1212","tags":["government-resource","US Government Resource"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-1212"},{"url":"https://freeloadbalancer.com"},{"url":"https://kemptechnologies.com"},{"url":"https://github.com/advisories/GHSA-8vv7-j7w3-28ww"}],"sources":{"cve":[{"id":"CVE-2024-1212","title":"LoadMaster Pre-Authenticated OS Command Injection","description":"Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.","status":"published","published":"2024-02-21T17:39:12.599Z","modified":"2025-10-21T23:05:23.864Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"cna"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:34:17.865042Z"}],"euvd":[{"id":"EUVD-2024-16979","description":"Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.","status":"published","published":"2024-02-21T17:39:12Z","modified":"2025-10-21T23:05:23Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"exploited_since":"2024-11-18","updated_at":"2026-11-02T20:31:28.525814Z"}],"ghsa":[{"id":"GHSA-8vv7-j7w3-28ww","title":"Unauthenticated remote attackers can access the system through the LoadMaster management...","description":"Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.","status":"published","published":"2024-02-21T18:31:02Z","modified":"2026-03-18T05:06:32Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T15:06:41.030615Z"}],"kev":[{"id":"CVE-2024-1212","title":"Progress Kemp LoadMaster OS Command Injection Vulnerability","description":"Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.","cwes":["CWE-78"],"kev":{"date_added":"2024-11-18","due_date":"2024-12-09","required_action":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","known_ransomware_use":"Unknown"},"updated_at":"2026-11-02T17:00:16.234141Z"}],"nvd":[{"id":"CVE-2024-1212","description":"Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.","status":"published","published":"2024-02-21T18:15:50.417Z","modified":"2026-07-13T19:49:31.12Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-78"],"updated_at":"2026-11-02T14:09:37.655131Z"}]}}