PT-2026-2442 · Progress · Progress Loadmaster

Alex Williams · Publicado 2026-01-13 · Atualizado 2026-02-02 · CVE-2025-13444

Positive Technologies (AI Summary)

CVSS v3.1

8.4

Alta

Vetor base

AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Progress LoadMaster (affected versions not specified)

Description An authenticated attacker with “User Administration” permissions can execute arbitrary commands on the LoadMaster appliance. This is due to unsanitized input in the API input parameters, leading to an OS Command Injection Remote Code Execution. The issue affects the API functionality of the software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2025-13444

ZDI-26-052

Produtos afetados

Progress Loadmaster

Referências · 9

• https://twitter.com/CVEnew/status/2011089097121505558 · Publicação no Twitter
• https://twitter.com/TheHackerWire/status/2011106161416957966 · Publicação no Twitter
• https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Aviso do Fabricante
• https://zerodayinitiative.com/advisories/ZDI-26-052 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2025-13444 · Aviso do Fabricante
• https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Aviso do Fabricante
• https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Aviso do Fabricante
• https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE-2025-13447 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2025-13444 · Nota de Segurança