Database/Control plane, storage & DevOps
Kemp LoadMaster (LMOS): A flaw in session management lets a remote, unauthenticated attacker bypass the LoadMaster's
Impact
A flaw in session management lets a remote, unauthenticated attacker bypass the LoadMaster's security protections entirely and run elevated shell commands (ls, ps, cat, etc.) — enough to pull certificates, private keys, and other sensitive data off the load balancer.
Who can reach it
Fully remote and unauthenticated against the LoadMaster's management interface.
What to do
Software upgrade to LMOS 7.1.35.5 (LTS) or 7.2.41.2+ (mainline) per Kemp's mitigation article. Upgrade and reboot; if this LoadMaster fronts live inference traffic, fail over to a standby instance during the update. Also rotate any certificates/keys that were on the device, since the bug allowed reading them.
References
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.