CISA Alert: Active Exploitation of VMware vCenter and Kemp LoadMaster Flaws

Now-patched security flaws impacting Progress Kemp LoadMaster and VMware vCenter Server have come under active exploitation in the wild, it has emerged.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added CVE-2024-1212 (CVSS score: 10.0), a maximum-severity security vulnerability in Progress Kemp LoadMaster to its Known Exploited Vulnerabilities (KEV) catalog. It was addressed by Progress Software back in February 2024.

"Progress Kemp LoadMaster contains an OS command injection vulnerability that allows an unauthenticated, remote attacker to access the system through the LoadMaster management interface, enabling arbitrary system command execution," the agency said.

Rhino Security Labs, which discovered and reported the flaw, said successful exploitation enables command execution on LoadMaster should an attacker have access to the administrator web user interface, granting them full access to the load balancer.

CISA's addition of CVE-2024-1212 coincides with a warning from Broadcom that attackers are now exploiting two security flaws in the VMware vCenter Server, which were demonstrated at the Matrix Cup cybersecurity competition held in China earlier this year.

The flaws, CVE-2024-38812 (CVSS score: 9.8) and CVE-2024-38813 (CVSS score: 7.5), were originally resolved in September 2024, although the company rolled out fixes for the former a second-time last month, stating the previous patches "did not fully address" the problem.

• CVE-2024-38812 - A heap-overflow vulnerability in the implementation of the DCERPC protocol that could permit a malicious actor with network access to obtain remote code execution

• CVE-2024-38813 - A privilege escalation vulnerability that could permit a malicious actor with network access to escalate privileges to root

While there are currently no details on the observed exploitation of these vulnerabilities in real-world attacks, CISA is recommending that Federal Civilian Executive Branch (FCEB) agencies remediate CVE-2024-1212 by December 9, 2024, to secure their networks.

The development comes days after Sophos revealed that cybercrime actors are actively weaponizing a critical flaw in Veeam Backup & Replication (CVE-2024-40711, CVSS score: 9.8) to deploy a previously undocumented ransomware called Frag.

PAN-OS Firewall Vulnerability Under Active Exploitation – IoCs and Patch Released

Chinese Hackers Exploit T-Mobile and Other U.S. Telecoms in Broader Espionage Campaign

Free online web security scanner