EXECUTIVE SUMMARY:
A critical vulnerability, CVE-2024-7591, impacting Progress Software’s LoadMaster and LoadMaster Multi-Tenant (MT) Hypervisor products, with a severity score of 10/10. The flaw stems from improper input validation that allows unauthenticated, remote attackers to exploit the device's management interface via a specially crafted HTTP request. If successful, attackers can execute arbitrary system commands on affected endpoints due to insufficient input sanitization. This vulnerability affects all LoadMaster versions up to 7.2.60.0, as well as MT Hypervisor up to version 7.1.35.11. While Progress has released an add-on package to mitigate the issue, the fix does not cover the free version of LoadMaster, leaving it exposed. Users of affected versions are urged to apply the add-on immediately and follow security hardening measures to protect their systems. Although no active exploitation has been reported, the flaw poses significant risks due to its potential for remote command execution, making it essential for organizations to act swiftly in securing their environments. LoadMaster, commonly used in large organizations for application delivery and network traffic management, could face serious disruptions if this vulnerability is exploited.[/subscribe_to_unlock_form]
EXECUTIVE SUMMARY:
A critical vulnerability, CVE-2024-7591, impacting Progress Software’s LoadMaster and LoadMaster Multi-Tenant (MT) Hypervisor products, with a severity score of 10/10. The flaw stems from improper input validation that allows unauthenticated, remote attackers to exploit the device's management interface via a specially crafted HTTP request. If successful, attackers can execute arbitrary system commands on affected endpoints due to insufficient input sanitization. This vulnerability affects all LoadMaster versions up to 7.2.60.0, as well as MT Hypervisor up to version 7.1.35.11. While Progress has released an add-on package to mitigate the issue, the fix does not cover the free version of LoadMaster, leaving it exposed. Users of affected versions are urged to apply the add-on immediately and follow security hardening measures to protect their systems. Although no active exploitation has been reported, the flaw poses significant risks due to its potential for remote command execution, making it essential for organizations to act swiftly in securing their environments. LoadMaster, commonly used in large organizations for application delivery and network traffic management, could face serious disruptions if this vulnerability is exploited.[emaillocker id="1283"]
RECOMMENDATION:
REFERENCES:
The following reports contain further technical details:
[/emaillocker]