OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster (Progress Software LoadMaster)
At a glance
- Source
- NVD
- EPSS
- EPSS 27.22 % · percentile 98 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- ProgressSoftware
- NVD status
- Analyzed
Description
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
Weaknesses (CWE)
- CWE-78 — Improper Neutralization of Special Elements used in an OS Command
References
- https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
- https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
- https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
- https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | ProgressSoftware |
| CVSS 3.1 | HIGH 8.4 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | NVD · security@progress.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.8 | CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Primary) |
European references
- ENISA EUVD · EUVD-2026-2346
- GCVE · GCVE-0-2025-13447
Affected configurations (NVD CPE)
cpe:2.3:a:progress:connection_manager_for_objectscale*:*:*:*:*:*:*:*:*< 7.2.62.2cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:*< 7.2.62.2cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:*< 7.2.54.16cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:*< 7.2.62.2cpe:2.3:a:progress:moveit_waf:7.2.62.1:*:*:*:*:*:*:*cpe:2.3:a:progress:multi-tenant_hypervisor:*:*:*:*:*:*:*:*< 7.1.35.15
Affected products
| Product | Versions |
|---|---|
| Progress Software · LoadMaster | affected 7.2.50 < V7.2.62.2 ; affected 7.1.32 < V7.2.62.2 ; affected 7.2.37 < V7.2.62.2 ; affected 7.2.39 < V7.2.62.2 ; affected 7.2.50 < V7.2.54.16 ; affected 7.1.32 < V7.2.54.16 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |