{"id":"CVE-2025-13447","state":"PUBLISHED","title":"OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster","description":"OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters","publishedAt":"2026-01-13T14:31:56.911Z","updatedAt":"2026-02-26T15:04:45.811Z","severity":{"score":8.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","source":"ProgressSoftware"},"assigner":"ProgressSoftware","products":["Progress Software LoadMaster"],"affected":[{"vendor":"Progress Software","product":"LoadMaster","defaultStatus":"unaffected","versions":[{"version":"7.2.50","status":"affected","lessThan":"V7.2.62.2","versionType":"custom"},{"version":"7.1.32","status":"affected","lessThan":"V7.2.62.2","versionType":"custom"},{"version":"7.2.37","status":"affected","lessThan":"V7.2.62.2","versionType":"custom"},{"version":"7.2.39","status":"affected","lessThan":"V7.2.62.2","versionType":"custom"},{"version":"7.2.50","status":"affected","lessThan":"V7.2.54.16","versionType":"custom"},{"version":"7.1.32","status":"affected","lessThan":"V7.2.54.16","versionType":"custom"},{"version":"7.2.37","status":"affected","lessThan":"V7.2.54.16","versionType":"custom"},{"version":"7.2.39","status":"affected","lessThan":"V7.2.54.16","versionType":"custom"}],"platforms":["LoadMaster Appliance","MOVEit WAF Appliance","ECS Appliance","ObjectScale Appliance"]}],"references":["https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447","https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447","https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE-2025-13447","https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447"],"weaknesses":[],"ingestedAt":"2026-10-29T20:08:31.050Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2025/13xxx/CVE-2025-13447.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2025-13447","state":"PUBLISHED","datePublished":"2026-01-13T14:31:56.911Z","dateUpdated":"2026-02-26T15:04:45.811Z","assignerShortName":"ProgressSoftware","assignerOrgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","dateReserved":"2025-11-19T19:18:13.816Z"},"containers":{"cna":{"title":"OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster","descriptions":[{"lang":"en","value":"OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters"}],"affected":[{"vendor":"Progress Software","product":"LoadMaster","defaultStatus":"unaffected","versions":[{"version":"7.2.50","status":"affected","lessThan":"V7.2.62.2","versionType":"custom"},{"version":"7.1.32","status":"affected","lessThan":"V7.2.62.2","versionType":"custom"},{"version":"7.2.37","status":"affected","lessThan":"V7.2.62.2","versionType":"custom"},{"version":"7.2.39","status":"affected","lessThan":"V7.2.62.2","versionType":"custom"},{"version":"7.2.50","status":"affected","lessThan":"V7.2.54.16","versionType":"custom"},{"version":"7.1.32","status":"affected","lessThan":"V7.2.54.16","versionType":"custom"},{"version":"7.2.37","status":"affected","lessThan":"V7.2.54.16","versionType":"custom"},{"version":"7.2.39","status":"affected","lessThan":"V7.2.54.16","versionType":"custom"}],"platforms":["LoadMaster Appliance","MOVEit WAF Appliance","ECS Appliance","ObjectScale Appliance"]}],"references":[{"url":"https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447","tags":["vendor-advisory"]},{"url":"https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447","tags":["vendor-advisory"]},{"url":"https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE-2025-13447","tags":["vendor-advisory"]},{"url":"https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447","tags":["vendor-advisory"]}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"ADJACENT_NETWORK","availabilityImpact":"HIGH","baseScore":8.4,"baseSeverity":"HIGH","confidentialityImpact":"HIGH","integrityImpact":"HIGH","privilegesRequired":"HIGH","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"description":"Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’)","lang":"en","type":"CWE"}]}],"providerMetadata":{"shortName":"ProgressSoftware","orgId":"f9fea0b6-671e-4eea-8fde-31911902ae05","dateUpdated":"2026-01-13T14:31:56.911Z"},"credits":[{"lang":"en","type":"finder","value":"Alex Williams from Converge Technology Solutions working with Trend Micro Zero Day Initiative"}],"impacts":[{"descriptions":[{"lang":"en","value":"OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters"}]}],"source":{"discovery":"EXTERNAL"},"x_generator":{"engine":"Vulnogram 0.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2025-13447","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-01-14T04:57:19.495084Z"}}}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-02-26T15:04:45.811Z"}}]}}}