CVE-2024-7591: Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 39.2% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2024-09-05 · updated 2026-06-17
Weakness: CWE-78

Description

Improper Input Validation vulnerability in Progress LoadMaster allows OS Command Injection.This issue affects: * LoadMaster: 7.2.40.0 and above * ECS: All versions * Multi-Tenancy: 7.1.35.4 and above

Affected products

Kemptechnologies Loadmaster: from 7.2.40.0 through 7.2.60.0
Kemptechnologies Multi-Tenant Hypervisor Firmware: from 7.1.35.4 before 7.1.35.11 — fixed in 7.1.35.11

How to fix

Upgrade to a fixed version: Kemptechnologies Multi-Tenant Hypervisor Firmware 7.1.35.11. Check the vendor advisory for mitigations.

References

https://insinuator.net/2024/11/vulnerability-disclosure-command-injection-in-kemp-loadmaster-load-balancer-cve-2024-7591
https://support.kemptechnologies.com/hc/en-us/articles/29196371689613-LoadMaster-Security-Vulnerability-CVE-2024-7591

Get alerted when CVE-2024-7591 or the next vulnerability affects your stack