CVE-2024-3544 - LoadMaster Hardcoded SSH Key

Back Back to CVE browser

HIGH

LoadMaster Hardcoded SSH Key

Published May 2, 2024

7.5

HIGH

CVSS 3.1

EPSS 0.38%

Description

Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.

Affected products

Vendor Progress Software Corporation Product LoadMaster Default
affected
- Version
  LoadMaster 7.2.48.11 (LTS)
  Status
  affected
  Constraints
  <7.2.48.12
- Version
  LoadMaster 7.2.49.0 (LTSF)
  Status
  affected
  Constraints
  <7.2.54.10
- Version
  LoadMaster 7.2.55.0 (GA)
  Status
  affected
  Constraints
  <7.2.59.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Progress Software Corporation

LoadMaster

affected

Version	Status	Constraints
LoadMaster 7.2.48.11 (LTS)	affected	<7.2.48.12
LoadMaster 7.2.49.0 (LTSF)	affected	<7.2.54.10
LoadMaster 7.2.55.0 (GA)	affected	<7.2.59.4

Vendor Kemptechnologies Product Loadmaster Default
affected
- Version
  7.2.48.11\(lts\)
  Status
  affected
  Constraints
  <7.2.48.12
- Version
  7.2.49.0\(ltsf\)
  Status
  affected
  Constraints
  <7.2.54.10
- Version
  7.2.55.0\(ga\)
  Status
  affected
  Constraints
  <7.2.59.4

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

Kemptechnologies

Loadmaster

affected

Version	Status	Constraints
7.2.48.11\(lts\)	affected	<7.2.48.12
7.2.49.0\(ltsf\)	affected	<7.2.54.10
7.2.55.0\(ga\)	affected	<7.2.59.4

Remediation

No remediation recorded yet.

Weaknesses (1)

CWE-798

Hard-coded Credentials

References (3)

https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-32130
Advisory
https://kemptechnologies.com/
product
https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543
vendor-advisoryProduct

Link	Providers	Tags
https://euvd.enisa.europa.eu/vulnerability/EUVD-2024-32130		Advisory
https://kemptechnologies.com/		product
https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543		vendor-advisoryProduct