CVE-2024-56134: Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection.

Severity: medium (CVSS 6.8 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-02-05 · updated 2026-06-17
Weakness: CWE-20

Description

Improper Input Validation vulnerability of Authenticated User in Progress LoadMaster allows : OS Command Injection. This issue affects:  Product Affected Versions LoadMaster From 7.2.55.0 to 7.2.60.1 (inclusive)   From 7.2.49.0 to 7.2.54.12 (inclusive)   7.2.48.12 and all prior versions Multi-Tenant Hypervisor 7.1.35.12 and all prior versions ECS All prior versions to 7.2.60.1 (inclusive)

Affected products

Progress Software LoadMaster: through 7.2.48.12; from 7.2.49.0 before 7.2.54.13; from 7.2.55.0 before 7.2.61.0 — fixed in 7.2.54.13, 7.2.61.0
Progress Multi-Tenant Loadmaster: before 7.1.35.13 — fixed in 7.1.35.13

How to fix

Upgrade to a fixed version: Progress Software LoadMaster 7.2.54.13, 7.2.61.0; Progress Multi-Tenant Loadmaster 7.1.35.13. Check the vendor advisory for mitigations.

References

https://community.progress.com/s/article/LoadMaster-Security-Vulnerability-CVE-2024-56131-CVE-2024-56132-CVE-2024-56133-CVE-2024-56134-CVE-2024-56135

Get alerted when CVE-2024-56134 or the next vulnerability affects your stack