Description
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Progress Software LoadMaster
Default version status: unaffected
7.2.50 to < V7.2.62.2affected7.1.32 to < V7.2.62.2affected7.2.37 to < V7.2.62.2affected7.2.39 to < V7.2.62.2affected7.2.50 to < V7.2.54.16affected7.1.32 to < V7.2.54.16affected7.2.37 to < V7.2.54.16affected7.2.39 to < V7.2.54.16affected
References
- https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 ↗
- https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 ↗
- https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 ↗
- https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 ↗