CVE-2025-13444High· 8.4▾ TwilightOS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsani…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 46.2 · likelihood 5.4 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 11.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
25%
25% → 27%
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
connection_manager_for_objectscale < 7.2.62.2ecs_connection_manager < 7.2.62.2moveit_web_application_firewall = 7.2.62.1multi-tenant_hypervisor < 7.1.35.15loadmaster < 7.2.54.16loadmaster >= 7.2.55.0, < 7.2.62.2Upgrade past the affected range:
connection_manager_for_objectscale 7.2.62.2ecs_connection_manager 7.2.62.2multi-tenant_hypervisor 7.1.35.15loadmaster 7.2.62.2Connected by shared product, vendor, weakness, or advisory.
CVE-2024-1212Critical· 10.0Unauthenticated remote attackers can access the system through the LoadMaster management interface, enabling arbitrary system command execution.
CVE-2026-8037Critical· 9.6OS Command Injection Remote Code Execution Vulnerability in API in Progress ADC Products allows an un-authenticated attacker to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in multiple command en…
CVE-2026-3692High· 8.8In Progress Flowmon versions prior to 12.5.8, a vulnerability exists whereby an authenticated low-privileged user may craft a request during the report generation process that results in unintended commands being executed on the server.
CVE-2022-33186Critical· 9.8A vulnerability in Brocade Fabric OS software v9.1.1, v9.0.1e, v8.2.3c, v7.4.2j, and earlier versions could allow a remote unauthenticated attacker to execute on a Brocade Fabric OS switch commands capable of modifying zoning, disabling …
CVE-2022-37902High· 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface
CVE-2022-37899High· 7.2Authenticated command injection vulnerabilities exist in the ArubaOS command line interface