CVE-2025-13447

OS Command Injection Remote Code Execution Vulnerability in Progress LoadMaster

En bref

Sévérité: HIGH 8.4
EPSS: EPSS 27.22 % · centile 98 (2026-10-27)
État: PUBLISHED
Publiée: 2026-01-13
Mise à jour: 2026-02-26
Attribuée par: ProgressSoftware
Statut NVD: Analyzed

Description

OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters

Scores

Version	Score	Vecteur	Évalué par
CVSS 3.1	HIGH 8.4	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	ProgressSoftware
CVSS 3.1	HIGH 8.4	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H	NVD · security@progress.com (Secondary)
CVSS 3.1	MEDIUM 6.8	CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)

Faiblesses (CWE)

CWE-78

Références européennes

ENISA EUVD · EUVD-2026-2346
GCVE · GCVE-0-2025-13447

Configurations affectées (CPE NVD)

cpe:2.3:a:progress:connection_manager_for_objectscale*:*:*:*:*:*:*:*:* < 7.2.62.2
cpe:2.3:a:progress:ecs_connection_manager:*:*:*:*:*:*:*:* < 7.2.62.2
cpe:2.3:a:progress:loadmaster:*:*:*:*:ltsf:*:*:* < 7.2.54.16
cpe:2.3:a:progress:loadmaster:*:*:*:*:ga:*:*:* < 7.2.62.2
cpe:2.3:a:progress:moveit_waf:7.2.62.1:*:*:*:*:*:*:*
cpe:2.3:a:progress:multi-tenant_hypervisor:*:*:*:*:*:*:*:* < 7.1.35.15

Produits affectés

Produit	Versions
Progress Software · LoadMaster	affected 7.2.50 < V7.2.62.2 ; affected 7.1.32 < V7.2.62.2 ; affected 7.2.37 < V7.2.62.2 ; affected 7.2.39 < V7.2.62.2 ; affected 7.2.50 < V7.2.54.16 ; affected 7.1.32 < V7.2.54.16

Références

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD