A flaw in the progressive ADC product suite allows an authenticated attacker with "All" permissions to send a "killsession" command that is not properly sanitized, resulting in OS command injection. This enables full control over the appliance, including the ability to read, modify, or delete data and potentially compromise the entire network segment the device resides on. The weakness corresponds to CWE‑77.

The vulnerability affects Progress Software ECS Connections Manager, LoadMaster, MOVEit WAF, and Object Scale Connection Manager. Specific version information is not disclosed; any installation exposing the vulnerable killsession API endpoint should be treated as potentially affected.

The CVSS score of 8.4 indicates a high severity for authenticated remote code execution. The EPSS score is not available, and the vulnerability has not been listed in the CISA KEV catalog. An attacker would need valid credentials with "All" permissions to trigger the injection, which can be achieved through credential compromise or mis‑configuration, thereby enabling full control of the appliance.