Progress LoadMaster OS Command Injection Remote Code Execution Vulnerability

A remote code execution vulnerability has been identified in the Progress LoadMaster API. This issue arises from unsanitized input in the API parameters, allowing an authenticated attacker with 'User Administration' permissions to execute arbitrary commands on the LoadMaster appliance.

Impact

Exploitation of this vulnerability allows for command injection, enabling authenticated attackers to execute arbitrary commands on the affected LoadMaster appliance.

Remediation

A patch for this vulnerability has been released and is available for download. Instructions for updating LoadMaster can be found in the 'Updating the LoadMaster Software' technical note on the Progress Community Portal. Customers under a current support contract can also contact Progress Technical Support for assistance.