Vulnerability Details CVE-2025-13444
OS Command Injection Remote Code Execution Vulnerability in API in Progress LoadMaster allows an authenticated attacker with “User Administration” permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 53.0%
CVSS Severity
CVSS v3 Score 8.4
References
- https://community.progress.com/s/article/Connection-Manager-for-ObjectScale-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
- https://community.progress.com/s/article/ECS-Connection-Manager-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
- https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
- https://community.progress.com/s/article/MOVEit-WAF-Vulnerabilities-CVE-2025-13444-CVE-2025-13447
Products affected by CVE-2025-13444
-
cpe:2.3:a:progress:connection_manager_for_objectscale*:*
-
cpe:2.3:a:progress:ecs_connection_manager:*
-
cpe:2.3:a:progress:loadmaster:*
-
cpe:2.3:a:progress:moveit_waf:7.2.62.1
-
cpe:2.3:a:progress:multi-tenant_hypervisor:*