CVE-2025-13444 – This CVE describes an OS command injection vuln... (How to Fix)

Q: What is the severity of CVE-2025-13444?

CVE-2025-13444 has a CVSS score of 8.4 (HIGH). This CVE describes an OS command injection vulnerability in Progress LoadMaster's API that allows authenticated attackers with 'User Administration' permissions to execute arbitrary commands on the appliance. The vulnerability stems from unsanitized input in API parameters, potentially leading to remote code execution. Organizations using affected Progress products (LoadMaster, Connection Manager, MOVEit WAF) are at risk.

📋 TL;DR

This CVE describes an OS command injection vulnerability in Progress LoadMaster's API that allows authenticated attackers with 'User Administration' permissions to execute arbitrary commands on the appliance. The vulnerability stems from unsanitized input in API parameters, potentially leading to remote code execution. Organizations using affected Progress products (LoadMaster, Connection Manager, MOVEit WAF) are at risk.

💻 Affected Systems

Products:

Progress LoadMaster
Progress Connection Manager for ObjectScale
Progress Connection Manager for ECS
Progress MOVEit WAF

Versions: Specific versions not detailed in references; check vendor advisories

Operating Systems: LoadMaster appliance OS

Default Config Vulnerable: ⚠️ Yes

Notes: Requires authenticated access with 'User Administration' permissions. Affects API endpoints in these products.

📦 What is this software?

⚠️ Risk & Real-World Impact

🔴

Worst Case

Complete compromise of the LoadMaster appliance leading to lateral movement into connected systems, data exfiltration, and persistent backdoor installation.

🟠

Likely Case

Attacker gains shell access to the appliance, modifies configurations, steals credentials, and disrupts load balancing services.

🟢

If Mitigated

Limited impact due to network segmentation, strong authentication controls, and minimal user permissions.

🌐 Internet-Facing: HIGH - API endpoints exposed to internet could be targeted by authenticated attackers.

🏢 Internal Only: MEDIUM - Requires authenticated access but internal attackers or compromised accounts could exploit.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: UNKNOWN

Unauthenticated Exploit: ✅ No

Complexity: LOW - Simple command injection via API parameters

Exploitation requires valid credentials with specific permissions. No public exploit code identified in references.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Check vendor advisories for specific patched versions

Vendor Advisory: https://community.progress.com/s/article/LoadMaster-Vulnerabilities-CVE-2025-13444-CVE-2025-13447

Restart Required: Yes

Instructions:

1. Review vendor advisories for affected versions. 2. Apply vendor-provided patches/updates. 3. Restart affected services/appliances. 4. Verify patch application.

🔧 Temporary Workarounds

Restrict API Access

all

Limit network access to API endpoints to trusted IPs only

Configure firewall rules to restrict API port access
Implement network segmentation for management interfaces

Reduce User Permissions

all

Minimize accounts with 'User Administration' permissions

Review and remove unnecessary admin privileges
Implement least privilege principle

🧯 If You Can't Patch

Implement strict input validation and sanitization for all API parameters
Deploy web application firewall (WAF) with command injection rules

🔍 How to Verify

Check if Vulnerable:

Check if running affected Progress products and review version against vendor advisories

Check Version:

Check product-specific version commands (varies by product)

Verify Fix Applied:

Verify patch version matches vendor recommendations and test API input validation

📡 Detection & Monitoring

Log Indicators:

Unusual API requests with shell metacharacters
Multiple failed authentication attempts followed by successful login
Commands executed via API that don't match normal patterns

Network Indicators:

Unusual outbound connections from LoadMaster appliances
Traffic to unexpected ports from management interfaces

SIEM Query:

source="loadmaster" AND (api_command INJECT OR suspicious_characters IN request_body)

📊 Metadata

CVE ID: CVE-2025-13444

CVSS v3 Score: 8.4 (HIGH)

CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE: CWE-78

EPSS Score: 0.02% exploit probability (4.3th percentile)

Published: January 13, 2026

Last Updated: February 13, 2026

🔗 References

📤 Share & Export

📄 Export Markdown 📋 Export JSON

🔗 Related Vulnerabilities

If you're affected by CVE-2025-13444, you might also want to check these: