{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-3544", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "state": "PUBLISHED", "assignerShortName": "ProgressSoftware", "dateReserved": "2024-04-09T18:05:52.839Z", "datePublished": "2024-05-02T14:08:06.683Z", "dateUpdated": "2024-08-01T20:12:07.654Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "affected", "product": "LoadMaster", "vendor": "Progress Software Corporation", "versions": [{"lessThan": "7.2.59.4", "status": "affected", "version": "LoadMaster 7.2.55.0 (GA)", "versionType": "semver"}, {"lessThan": "7.2.54.10", "status": "affected", "version": "LoadMaster 7.2.49.0 (LTSF)", "versionType": "semver"}, {"lessThan": "7.2.48.12", "status": "affected", "version": "LoadMaster 7.2.48.11 (LTS)", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Agenzia per la Cybersicurezza Nazionale (ACN)"}], "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "\n\nUnauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.\n\n"}], "value": "\nUnauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.\n\n"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115: Authentication Bypass"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-798", "description": "CWE-798: Use of Hard-coded Credentials", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2024-05-07T11:59:50.733Z"}, "references": [{"tags": ["product"], "url": "https://kemptechnologies.com/"}, {"tags": ["vendor-advisory"], "url": "https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543"}], "source": {"discovery": "UNKNOWN"}, "title": "LoadMaster Hardcoded SSH Key", "x_generator": {"engine": "Vulnogram 0.1.0-dev"}}, "adp": [{"affected": [{"vendor": "kemptechnologies", "product": "loadmaster", "cpes": ["cpe:2.3:a:kemptechnologies:loadmaster:7.2.55.0\\(ga\\):*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "7.2.55.0\\(ga\\)", "status": "affected", "lessThan": "7.2.59.4", "versionType": "custom"}]}, {"vendor": "kemptechnologies", "product": "loadmaster", "cpes": ["cpe:2.3:a:kemptechnologies:loadmaster:7.2.49.0\\(ltsf\\):*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "7.2.49.0\\(ltsf\\)", "status": "affected", "lessThan": "7.2.54.10", "versionType": "custom"}]}, {"vendor": "kemptechnologies", "product": "loadmaster", "cpes": ["cpe:2.3:a:kemptechnologies:loadmaster:7.2.48.11\\(lts\\):*:*:*:*:*:*:*"], "defaultStatus": "affected", "versions": [{"version": "7.2.48.11\\(lts\\)", "status": "affected", "lessThan": "7.2.48.12", "versionType": "custom"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-07-01T21:03:12.546232Z", "id": "CVE-2024-3544", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-01T21:41:23.951Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:12:07.654Z"}, "title": "CVE Program Container", "references": [{"tags": ["product", "x_transferred"], "url": "https://kemptechnologies.com/"}, {"tags": ["vendor-advisory", "x_transferred"], "url": "https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://kemptechnologies.com/", "tags": ["product", "x_transferred"]}, {"url": "https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543", "tags": ["vendor-advisory", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-01T20:12:07.654Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-3544", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-07-01T21:03:12.546232Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:kemptechnologies:loadmaster:7.2.55.0\\(ga\\):*:*:*:*:*:*:*"], "vendor": "kemptechnologies", "product": "loadmaster", "versions": [{"status": "affected", "version": "7.2.55.0\\(ga\\)", "lessThan": "7.2.59.4", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:kemptechnologies:loadmaster:7.2.49.0\\(ltsf\\):*:*:*:*:*:*:*"], "vendor": "kemptechnologies", "product": "loadmaster", "versions": [{"status": "affected", "version": "7.2.49.0\\(ltsf\\)", "lessThan": "7.2.54.10", "versionType": "custom"}], "defaultStatus": "affected"}, {"cpes": ["cpe:2.3:a:kemptechnologies:loadmaster:7.2.48.11\\(lts\\):*:*:*:*:*:*:*"], "vendor": "kemptechnologies", "product": "loadmaster", "versions": [{"status": "affected", "version": "7.2.48.11\\(lts\\)", "lessThan": "7.2.48.12", "versionType": "custom"}], "defaultStatus": "affected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-07-01T21:14:12.371Z"}}], "cna": {"title": "LoadMaster Hardcoded SSH Key", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Agenzia per la Cybersicurezza Nazionale (ACN)"}], "impacts": [{"capecId": "CAPEC-115", "descriptions": [{"lang": "en", "value": "CAPEC-115: Authentication Bypass"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "ADJACENT_NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "Progress Software Corporation", "product": "LoadMaster", "versions": [{"status": "affected", "version": "LoadMaster 7.2.55.0 (GA)", "lessThan": "7.2.59.4", "versionType": "semver"}, {"status": "affected", "version": "LoadMaster 7.2.49.0 (LTSF)", "lessThan": "7.2.54.10", "versionType": "semver"}, {"status": "affected", "version": "LoadMaster 7.2.48.11 (LTS)", "lessThan": "7.2.48.12", "versionType": "semver"}], "defaultStatus": "affected"}], "references": [{"url": "https://kemptechnologies.com/", "tags": ["product"]}, {"url": "https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543", "tags": ["vendor-advisory"]}], "x_generator": {"engine": "Vulnogram 0.1.0-dev"}, "descriptions": [{"lang": "en", "value": "\nUnauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.\n\n", "supportingMedia": [{"type": "text/html", "value": "\n\nUnauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.\n\n", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-798", "description": "CWE-798: Use of Hard-coded Credentials"}]}], "providerMetadata": {"orgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "shortName": "ProgressSoftware", "dateUpdated": "2024-05-07T11:59:50.733Z"}}}, "cveMetadata": {"cveId": "CVE-2024-3544", "state": "PUBLISHED", "dateUpdated": "2024-08-01T20:12:07.654Z", "dateReserved": "2024-04-09T18:05:52.839Z", "assignerOrgId": "f9fea0b6-671e-4eea-8fde-31911902ae05", "datePublished": "2024-05-02T14:08:06.683Z", "assignerShortName": "ProgressSoftware"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "\nUnauthenticated attackers can perform actions, using SSH private keys, by knowing the IP address and having access to the same network of one of the machines in the HA or Cluster group. This vulnerability has been closed by enhancing LoadMaster partner communications to require a shared secret that must be exchanged between the partners before communication can proceed.\n\n"}, {"lang": "es", "value": "Los atacantes no autenticados pueden realizar acciones utilizando claves privadas SSH conociendo la direcci\u00f3n IP y teniendo acceso a la misma red de una de las m\u00e1quinas del grupo HA o Cluster. Esta vulnerabilidad se ha solucionado mejorando las comunicaciones con los socios de LoadMaster para requerir un secreto compartido que debe intercambiarse entre los socios antes de que pueda continuar la comunicaci\u00f3n."}], "id": "CVE-2024-3544", "lastModified": "2024-05-02T18:00:37.360", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "ADJACENT_NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "security@progress.com", "type": "Secondary"}]}, "published": "2024-05-02T15:15:07.053", "references": [{"source": "security@progress.com", "url": "https://kemptechnologies.com/"}, {"source": "security@progress.com", "url": "https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543"}], "sourceIdentifier": "security@progress.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-798"}], "source": "security@progress.com", "type": "Secondary"}]}

{}