This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of Progress Software Kemp LoadMaster. Authentication is required to exploit this vulnerability.
The specific flaw exists within the handling of user data passed to the getcipherset command. The issue results from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this vulnerability to execute code in the context of the bal user.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
