CVE-2024-1212

CRITICAL10.0

CISA KEV

Published 2024-02-21 · Updated 2026-07-13 · Source security@progress.com

Description

Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWE-78CWE-78

CISA Known-Exploited Vulnerability

Product: Progress — Kemp LoadMaster

Name: Progress Kemp LoadMaster OS Command Injection Vulnerability

Date added: 2024-11-18 · Due: 2024-12-09

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

References

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-71958
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the quicksetup.cgi interface. A remote attacker can write overly long strings to the test4, ssid2, and username fields and execute arbitrary commands by crafting a specific payload, or cause the device to crash.
2026-08-08 · score 9.8
CVE-2026-71957
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a buffer overflow vulnerability in the app.cgi interface. A remote attacker can write an overly long string to the netAcc.addlist[].name field and execute arbitrary commands by crafting a specific payload, or cause the device to crash.
2026-08-08 · score 9.8
CVE-2026-71956
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the app.cgi interface. A remote attacker can inject arbitrary malicious commands into the netDig.ping.dst field, resulting in command execution with root privileges.
2026-08-08 · score 9.8
CVE-2026-71955
D-Link DWR-M961 devices with hardware version C1 and software version 1.1.2_C1_202602110044 contain a command injection vulnerability in the /boafrm/formWsc interface. A remote attacker can inject arbitrary malicious commands into the localPin, targetAPSsid, peerPin, and peerRptPin fields, resulting in command execution with root privileges.
2026-08-08 · score 9.8
CVE-2026-71954
D-Link DWR-M961 devices with hardware version C1 and firmware version before 1.1.5_C1_202607071108 contain a command injection vulnerability in the /boafrm/formL2tpv3ConfigSetup interface. A remote attacker can inject arbitrary malicious commands into the tunnelid and sessionid fields, resulting in command execution with root privileges.
2026-08-08 · score 9.8