---
id: "CVE-2024-1212"
kind: "vulnerability"
aliases: ["CVE-2024-1212"]
title: "progress loadmaster: Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling\u2026"
severity: "critical"
cvss: 10.0
epss: null
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Progress Kemp LoadMaster", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "progress loadmaster", "fixed": ["7.2.48.10"], "affected": ">= 7.2.48.1, < 7.2.48.10", "ecosystem": "vendor"}, {"name": "progress loadmaster", "fixed": ["7.2.54.8"], "affected": ">= 7.2.54.0, < 7.2.54.8", "ecosystem": "vendor"}, {"name": "progress loadmaster", "fixed": ["7.2.59.2"], "affected": ">= 7.2.55.0, < 7.2.59.2", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["appliance", "exploited", "infrastructure", "kemp-loadmaster", "load-balancer"]
not_affected_if: ["no-loadmaster-deployed"]
published_at: "2024-02-21T18:15:50+00:00"
first_seen_at: "2026-10-23T19:11:51+00:00"
updated_at: "2026-10-23T22:29:05+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-1212", "first_seen_at": "2026-10-23T19:11:51+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-1212", "first_seen_at": "2026-10-23T22:29:05+00:00"}]
---

# progress loadmaster: Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling…

Progress Kemp LoadMaster load balancers contain an OS command injection flaw in the management interface. An unauthenticated remote attacker can run arbitrary system commands on the appliance.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Progress Kemp LoadMaster affected ? fixed ?
- vendor:progress loadmaster affected >= 7.2.48.1, < 7.2.48.10 fixed 7.2.48.10
- vendor:progress loadmaster affected >= 7.2.54.0, < 7.2.54.8 fixed 7.2.54.8
- vendor:progress loadmaster affected >= 7.2.55.0, < 7.2.59.2 fixed 7.2.59.2

## Fix

Apply the mitigations from the vendor per CISA's required action, or stop using the product if no mitigation is available. Exact fixed versions: unknown.

## Timeline

- 2026-10-23T19:11:51+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-1212
- 2026-10-23T22:29:05+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2024-1212

## From the sources

Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution.

CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_