CVE-2025-13444: Progress LoadMaster API RCE Vulnerability

CVE-2025-13444 Overview

CVE-2025-13444 is an OS Command Injection vulnerability affecting the API in Progress LoadMaster and related products. This vulnerability allows an authenticated attacker with "User Administration" permissions to execute arbitrary commands on the LoadMaster appliance by exploiting unsanitized input in the API input parameters. The flaw represents a significant security risk as it enables remote code execution on affected appliances within the network environment.

Critical Impact

Authenticated attackers with administrative privileges can achieve full system compromise through arbitrary command execution, potentially leading to complete infrastructure takeover.

Affected Products

• Progress LoadMaster
• Progress MOVEit WAF
• Progress ECS Connection Manager
• Progress Connection Manager for ObjectScale

Discovery Timeline

• January 13, 2026 - CVE-2025-13444 published to NVD
• January 13, 2026 - Last updated in NVD database

Technical Details for CVE-2025-13444

Vulnerability Analysis

This vulnerability stems from insufficient input validation in the Progress LoadMaster API interface. When processing API requests, the application fails to properly sanitize user-supplied input before incorporating it into system commands. An attacker with "User Administration" permissions can craft malicious API requests containing command injection payloads that are subsequently executed with the privileges of the underlying system process.

The attack requires adjacent network access and high-level privileges, specifically "User Administration" permissions. However, once these prerequisites are met, the exploitation is straightforward with no user interaction required. The scope is changed, meaning successful exploitation can impact resources beyond the vulnerable component's security scope, potentially compromising confidentiality, integrity, and availability of the entire appliance and connected systems.

Root Cause

The root cause of CVE-2025-13444 is improper input sanitization within the API parameter handling logic. The application constructs operating system commands using user-controllable input without adequate validation or escaping of shell metacharacters. This allows specially crafted input containing command separators (such as semicolons, pipes, or backticks) to break out of the intended command context and inject arbitrary commands.

Attack Vector

The attack is conducted over an adjacent network, requiring the attacker to have authenticated access with "User Administration" privileges. The exploitation flow involves:

1. Authenticating to the LoadMaster management interface with User Administration credentials
2. Sending a crafted API request with malicious command injection payloads embedded in input parameters
3. The vulnerable API endpoint processes the input without proper sanitization
4. The injected commands are executed on the underlying operating system with the application's privileges

The vulnerability does not require user interaction and has low attack complexity once the attacker has the necessary access level. Technical details regarding specific exploitation techniques should be reviewed in the Progress LoadMaster Advisory.

Detection Methods for CVE-2025-13444

Indicators of Compromise

• Unusual or unexpected API calls to LoadMaster management endpoints from internal network segments
• Presence of shell metacharacters (;, |, `, $()) in API request logs
• Unexpected process spawning or child processes originating from LoadMaster application processes
• Unauthorized configuration changes or new administrative accounts

Detection Strategies

• Implement deep packet inspection for API traffic targeting LoadMaster management interfaces
• Configure SIEM rules to alert on API requests containing common command injection patterns
• Monitor for anomalous behavior from accounts with "User Administration" privileges
• Enable detailed audit logging on LoadMaster appliances to capture all API interactions

Monitoring Recommendations

• Review API access logs regularly for signs of malicious input or exploitation attempts
• Implement network segmentation monitoring to detect lateral movement from compromised appliances
• Deploy behavioral analytics to identify unusual administrative actions
• Establish baseline behavior for User Administration accounts and alert on deviations

How to Mitigate CVE-2025-13444

Immediate Actions Required

• Apply the latest security patches from Progress Software for all affected products immediately
• Audit all accounts with "User Administration" permissions and remove unnecessary access
• Restrict network access to LoadMaster management interfaces to trusted administrative segments only
• Review API access logs for signs of previous exploitation attempts

Patch Information

Progress Software has released security advisories addressing this vulnerability. Organizations should immediately apply the available patches by consulting the following vendor resources:

• Progress LoadMaster Advisory
• Progress MOVEit WAF Advisory
• Progress ECS Connection Manager Advisory
• Progress Connection Manager for ObjectScale Advisory

Workarounds

• Implement strict network access controls limiting API access to trusted IP addresses only
• Enforce multi-factor authentication for all administrative accounts
• Consider temporarily disabling User Administration functionality until patches are applied
• Deploy a Web Application Firewall (WAF) with command injection detection rules in front of management interfaces

# Example network access restriction (firewall rule)
# Restrict LoadMaster management API access to specific admin subnet
iptables -A INPUT -p tcp --dport 443 -s 10.0.100.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP