CISA Alert: Active Exploitation of VMware vCenter and Kemp LoadMaster Flaws

Now-patched security flaws impacting Progress Kemp LoadMaster and VMware vCenter Server have come under active exploitation in the wild, it has emerged.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added CVE-2024-1212 (CVSS score: 10.0), a maximum-severity security vulnerability in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog. It was addressed by Progress Software back in February 2024.

“Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution,” the agency said.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Rhino Security Labs, which discovered and reported the flaw, said successful exploitation enables command execution on LoadMaster should an attacker have access to the administrator web user interface, granting them full access to the load balancer.

CISA’s addition of CVE-2024-1212 coincides with a warning from Broadcom that attackers are now exploiting two security flaws in the VMware vCenter Server, which were demonstrated at the Matrix Cup cybersecurity competition held in China earlier this year.

The flaws, CVE-2024-38812 (CVSS score: 9.8) and CVE-2024-38813 (CVSS score: 7.5), were originally resolved in September 2024, although the company rolled out fixes for the former a second-time last month, stating the previous patches “did not fully address” the problem.

• CVE-2024-38812 – A heap-overflow vulnerability in the implementation of the DCERPC protocol that could permit a malicious actor with network access to obtain remote code execution

• CVE-2024-38813 – A privilege escalation vulnerability that could permit a malicious actor with network access to escalate privileges to root

While there are currently no details on the observed exploitation of these vulnerabilities in real-world attacks, CISA is recommending that Federal Civilian Executive Branch (FCEB) agencies remediate CVE-2024-1212 by December 9, 2024, to secure their networks.

The development comes days after Sophos revealed that cybercrime actors are actively weaponizing a critical flaw in Veeam Backup & Replication (CVE-2024-40711, CVSS score: 9.8) to deploy a previously undocumented ransomware called Frag.

Found this article interesting? Follow us on Twitter  and LinkedIn to read more exclusive content we post.