CVE-2024-2448: LoadMaster Command Injection Vulnerability

Severity: high (CVSS 8.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 55.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2024-03-22 · updated 2026-06-17
Weakness: CWE-78

Description

An OS command injection vulnerability has been identified in LoadMaster. An authenticated UI user with any permission settings may be able to inject commands into a UI component using a shell command resulting in OS command injection.

Affected products

Progress Software LoadMaster: from 7.2.49.0 before 7.2.54.9; from 7.2.55.0 before 7.2.59.3; 7.1.35.10, 7.2.48.10 — fixed in 7.2.54.9, 7.2.59.3

How to fix

Upgrade to a fixed version: Progress Software LoadMaster 7.2.54.9, 7.2.59.3. Check the vendor advisory for mitigations.

References

https://progress.com/loadmaster
https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449
https://progress.com/loadmaster
https://support.kemptechnologies.com/hc/en-us/articles/25119767150477-LoadMaster-Security-Vulnerabilities-CVE-2024-2448-and-CVE-2024-2449

Get alerted when CVE-2024-2448 or the next vulnerability affects your stack