Progress SoftwareExploited incident
Progress Kemp LoadMaster unauthenticated OS command injection via the management API
CVE-2024-1212Critical, CVSS 10.0In CISA's Known Exploited Vulnerabilities catalog since 18 Nov 2024
- Exploited after a fix existed
Response
- Silence
- same day First public report to first vendor statement
- Exposure
- same day First public report to first fix
- Follow-through
- same day First public report to a fix for every supported version
- Vendor silent
- Vendor statement, no fix
- Fixed for some versions
- Fixed when disclosed
- Date only, no time of day
Timeline and evidence
Open a moment to see its source and archived quote.
First public report
date only
Kemp Support release notice: LMOS 7.2.59.2, 7.2.54.8, 7.2.48.10 (CVE-2024-1212) (Wayback snapshot 2024-03-09)CuratedQuote verified
Firmware upgrade patches are now available for all active LoadMaster versions to close a reported security vulnerability
Notice shows 'Release Date: 07 February 2024' (and 'Updated: February 21, 2024 18:16', zone not stated). Coordinated disclosure (reported by Rhino Security Labs); exploitation was reported only later (KEV 2024-11-18). The KEV link now redirects to a JavaScript-only Progress community page, so the Kemp support snapshot is cited.
- Source
- Kemp Support release notice: LMOS 7.2.59.2, 7.2.54.8, 7.2.48.10 (CVE-2024-1212) (Wayback snapshot 2024-03-09) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:b1aa9fb94cc1e980…- Used in metrics
- Yes
4 more sources for this moment
CVE.org record CVE-2024-1212ClaimedQuote verified21 Feb 2024, 17:39 UTC
Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
CVE record published.
- Source
- CVE.org record CVE-2024-1212 cve record
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:7a29813fa47dff2f…- Used in metrics
- No, kept for the record
Bluesky postClaimedQuote not checked yet22 Feb 2024, 11:09 UTC
Progress Kremp LoadMaster - Vulnerability cve-2024-1212 patched in early Feb. 2024
Earliest third-party post we hold.
- Source
- Bluesky post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
Mastodon postClaimedQuote not checked yet19 Mar 2024, 15:12 UTC
Rhino Security Labs , submitters of CVE-2024-1212 (CVSS: 10.0 critical , disclosed 08 February 2024 by Progress) unauthenticated Command Injection In Progress Kemp LoadMaster, released vulnerability details and
Earliest third-party post we hold.
- Source
- Mastodon post social
- Recorded time
- Precision
- To the minute
- Origin
- Claimed. The date the source gives.
- Quote check
- Not checked yet
- Snapshot
- No archived snapshot
- Used in metrics
- No, kept for the record
CISA KEV (CVE-2024-1212)ClaimedQuote verified18 Nov 2024
Progress Kemp LoadMaster OS Command Injection Vulnerability
Added to CISA's KEV catalog on 2024-11-18.
- Source
- CISA KEV (CVE-2024-1212) kev
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Claimed. The date the source gives.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ef8fffede5c47200…- Used in metrics
- No, kept for the record
Vendor statement
date onlysame day
Kemp Support release notice (Wayback snapshot 2024-03-09)CuratedQuote verified
Release Date: 07 February 2024
- Source
- Kemp Support release notice (Wayback snapshot 2024-03-09) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:b1aa9fb94cc1e980…- Used in metrics
- Yes
First workaround
No official mitigation found yet.
First fix
date onlysame day
Kemp Support release notice (Wayback snapshot 2024-03-09)CuratedQuote verified
Firmware upgrade patches are now available for all active LoadMaster versions to close a reported security vulnerability
- Source
- Kemp Support release notice (Wayback snapshot 2024-03-09) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:b1aa9fb94cc1e980…- Used in metrics
- Yes
Fixed for all versions
date onlysame day
Kemp Support KB: LoadMaster Security Vulnerability CVE-2024-1212 (Wayback snapshot 2024-03-03)CuratedQuote verified
To close the security vulnerability, you must install one of the following security patches:
Patches for all three active lines released together: 7.2.59.2 (GA), 7.2.54.8 (LTSF), 7.2.48.10 (LTS). Free LoadMaster users must redeploy a non-vulnerable version. The KB shows 'Updated: February 28, 2024 21:18'; its first reader comments are dated February 08, 2024.
- Source
- Kemp Support KB: LoadMaster Security Vulnerability CVE-2024-1212 (Wayback snapshot 2024-03-03) vendor advisory
- Recorded time
- Precision
- Date only (no time of day is shown)
- Origin
- Curated. Found by a researcher, with a verbatim quote and link.
- Quote check
- Found in the archived copy
- Snapshot
sha256:ab1acda0939ca008…- Used in metrics
- Yes
Send this to your boss
No brief for this incident yet. We write one for every open incident and every critical bug exploited before a fix.
Affected products
- Progress Kemp LoadMaster (LMOS) releases after 7.2.48.1
- LoadMaster Multi-Tenant (MT) VFNs
How we built this timeline
Old bug added to KEV months after the fix (KEV 18 Nov 2024). Requires access to the LoadMaster management interface.
CVSS 10.0 is Progress's CNA score (NVD 9.8). Kemp became part of Progress; the vendor is mapped to 'progress' via KEV vendorProject 'Progress'.
Related
No related incidents.