Unauthenticated OS Command Injection RCE in Progress LoadMaster API

Successful exploitation allows an unauthenticated remote attacker to execute arbitrary OS commands on the affected LoadMaster appliance. The provided content indicates this can lead to total administrative control of the device and high impact to confidentiality, integrity, and availability. Because LoadMaster appliances commonly sit at the network edge or core application delivery path, compromise could enable service disruption, appliance tampering, interception or manipulation of traffic, deployment of malicious payloads, and use of the appliance as a pivot for deeper intrusion into the enterprise environment.

The provided content emphasizes immediate patching as the primary defense. Where patching cannot be performed immediately, reduce exposure of the vulnerable API by restricting internet reachability, limiting access to trusted administrative networks, and monitoring for suspicious requests to API command endpoints; however, no vendor-specific mitigation beyond applying the fixed firmware is provided in the supplied material.

Upgrade affected Progress Kemp LoadMaster deployments to the fixed firmware versions referenced in the advisory: v7.2.63.2 or v7.2.54.18. The provided content states that the fixes also apply to Progress ECS Connection Manager and Connection Manager for ObjectScale. Organizations without an active maintenance agreement are advised in the source material to contact their vendor partner to obtain the upgrade.