High severity · published May 2, 2024
CVE-2024-3544
LoadMaster Hardcoded SSH Key
7.5
CVSS
0.4%
EPSS
No
On KEV
Description
Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.
CVSS vector
CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Adjacent
Complexity
High
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 32% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
LO
LoadMaster · Progress Software Corporation
LoadMaster 7.2.55.0 (GA) before 7.2.59.4; LoadMaster 7.2.49.0 (LTSF) before 7.2.54.10; LoadMaster 7.2.48.11 (LTS) before 7.2.48.12 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-3544
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-3544
Product
https://kemptechnologies.com/
Product
https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543
More from LoadMaster
7.5
CVE-2024-3543
LoadMaster Reversible Password Encryption Algorithm