TL;DR

A vulnerability exists in the addapikey command of Kemp LoadMaster that allows for remote code execution with proper authentication.

What happened

["Command injection flaw identified in Kemp LoadMaster's addapikey API", 'Exploits require authenticated access']

Why it matters for ops

['Allows network-adjacent actors to execute arbitrary commands on target systems', 'Potentially leads to full system compromise if exploited successfully']

Mitigation

  • Apply vendor-provided patches immediately
  • Restrict API access to trusted networks and IPs only
  • Monitor for suspicious activity around the affected API endpoint

Action items

  • Review system configurations and network policies
  • Update Kemp LoadMaster to latest version with fixes
  • Increase monitoring of addapikey related activities

Detection IOCs

  • Unusual API calls from known bad IP addresses or unusual times
  • Unexpected command executions in server logs

Source link

http://www.zerodayinitiative.com/advisories/ZDI-26-055/