CVE-2024-3544 - CVE House
Back to Database
Status published High CVE-2024-3544

LoadMaster Hardcoded SSH Key

Vulnerability Description

Unauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-3544

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • Agenzia per la Cybersicurezza Nazionale (ACN)

References

More from Progress Software Corporation

View All →
CVE-2025-8095
Recoverable obfuscation using the OECH1 prefix encoding in OpenEdge
Critical 9.1
CVE-2025-7389
Unauthorized Arbitrary File Read via RMI in AdminServer Interface
High 8.2
CVE-2025-7388
Authenticated Command Injection via configuration parameter manipulation in exposed RMI interface
High 8.4
CVE-2025-2572
WhatsUp Gold NmConfigurationManager.exe database manipulation vulnerability
Medium 5.6
CVE-2025-1968
Insufficient Session Expiration vulnerability in Progress Software Corporation Sitefinity under...
High 7.7

Affected Vendor

Progress Software Corporation

View all reports →

Affected Software

LoadMaster
Vulnerable Versions:
LoadMaster 7.2.55.0 (GA), LoadMaster 7.2.49.0 (LTSF), LoadMaster 7.2.48.11 (LTS)

Timeline

Official Publish: May 2nd, 2024
Last Modified: August 1st, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses (CWE)

CWE-798

MITRE ATT&CK TTPs

T1552 Unsecured Credentials
Credential Access
T1078 Valid Accounts
Persistence
T1021 Remote Services
Lateral Movement
T1190 Exploit Public-Facing Application
Initial Access
T1098 Account Manipulation
Privilege Escalation