Easily encoded unsanitized input in the 'addcountry' API call allows an attacker with 'Geo Administration' rights to inject operating‑system commands. The flaw is a classic OS command injection (CWE‑77) and can lead to full remote code execution on the LoadMaster appliance. Because the vulnerability is accessed through API endpoints, an attacker can gain the same ability as the authenticated user, potentially compromising the entire ADC environment.

Progress Software’s ADC portfolio is affected. The products listed are LoadMaster, ECS Connections Manager, MOVEit WAF, and Object Scale Connection Manager. The CVE data does not specify affected releases or patch identifiers, so current installations of any version of these products should be evaluated for the presence of the 'addcountry' API and for the documented input validation flaw.

With a CVSS score of 8.4, this vulnerability falls into the high severity category. The EPSS score is not available, making it difficult to estimate how frequently exploit code is attempted against similar flaws, but the lack of a KEV listing suggests that it may not yet be actively exploited in the wild. The required conditions—valid credentials with Geo Administration, access to the vulnerable API, and unsanitized input—mean that an attacker can carry out the exploit remotely and without needing local privileges. The potential impact is complete compromise of the LoadMaster appliance, including data exfiltration, reboot, or service disruption.