Now-patched security flaws impacting Progress Kemp LoadMaster and VMware vCenter Server have come under active exploitation in the wild, it has emerged.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added CVE-2024-1212 (CVSS score: 10.0), a maximum-severity security vulnerability in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog. It was addressed by Progress Software back in February 2024.
“Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution,” the agency said.
Rhino Security Labs, which discovered and reported the flaw, said successful exploitation enables command execution on LoadMaster should an attacker have access to the administrator web user interface, granting them full access to the load balancer.
CISA’s addition of CVE-2024-1212 coincides with a warning from Broadcom that attackers are now exploiting two recently disclosed security flaws in VMware vCenter Server. The vulnerabilities were demonstrated at the Matrix Cup cybersecurity competition held in China back this June.
The flaws, CVE-2024-38812 (CVSS score: 9.8) and CVE-2024-38813 (CVSS score: 7.5), were originally resolved in September 2024, although the company rolled out fixes for the former a second-time last month, stating the previous patches “did not fully address” the problem.
- CVE-2024-38812 – A heap-overflow vulnerability in the implementation of the DCERPC protocol that could permit a malicious actor with network access to obtain remote code execution
- CVE-2024-38813 – A privilege escalation vulnerability that could permit a malicious actor with network access to escalate privileges to root
While there are currently no details on the observed exploitation of these vulnerabilities in real-world attacks, CISA is recommending that Federal Civilian Executive Branch (FCEB) agencies remediate CVE-2024-1212 by December 9, 2024, to secure their networks.
The development comes days after Sophos revealed that cybercrime actors are actively weaponizing a critical flaw in Veeam Backup & Replication (CVE-2024-40711, CVSS score: 9.8) to deploy a previously undocumented ransomware called Frag.
Update
CISA, on November 20, 2024, added the two VMware vCenter Server flaws to its KEV catalog, requiring FCEB agencies to apply mitigations per vendor instructions by December 11, 2024.
It’s worth noting that SonicWall, in a report published in late March 2024, said it detected “exploitation attempts” against CVE-2024-1212. However, the exact nature of the attacks and the targets are not clear.
