CVE-2024-3543 is a medium severity flaw (CVSS 6.4) in Progress Kemp LoadMaster, where passwords are protected with a reversible encryption algorithm. Anyone who obtains the protected values can recover the passwords. The record does not list a fixed version, so read the Progress advisory for your release branch and update to the build it names.
Weakness class: CWE-257, CWE-522.
What's affected
- Product: Progress Kemp LoadMaster, covering the GA, LTS and LTSF release branches in the record. The record also names LTS build 7.2.48.11 specifically.
- Severity: Medium, CVSS 6.4, per the record.
- Fixed versions: the record does not give them. The vendor article titled "ECS Connection Manager Security Vulnerabilities CVE-2024-3544 and CVE-2024-3543" is the place to confirm them. I could not retrieve its contents when preparing this post, so check it directly rather than relying on a number from a third party.
- Exploited in the wild: the record's KEV flag is false.
How to check if you're exposed
LoadMaster is an appliance, so there is no package manager to query. The steps are administrative.
- Sign in to the LoadMaster web interface and note the firmware version shown on the home or system page.
- Compare it with the fixed builds in the Progress advisory for your branch (GA, LTS or LTSF).
- List who can reach the management interface and the ECS Connection Manager component named in the advisory title. Anything reachable from a broad network deserves attention first.
- Ask which accounts or stored secrets were created or imported on that appliance, since those are the values the weak protection applies to.
What to do now
- Open the Progress advisory and find the fixed build for your branch.
- Schedule the firmware update for every LoadMaster in the estate, high availability pairs included.
- Restrict management access to a dedicated admin network or VPN.
- After updating, rotate passwords that were stored or managed on the affected appliance, because a reversible value that leaked earlier stays readable.
- Record the affected and fixed versions in your asset inventory so the next review is quick.
Why it matters
The weakness classes are CWE-257, storing passwords in a recoverable format, and CWE-522, insufficiently protected credentials. A password should be stored as a salted one-way hash, so that even someone holding the stored value cannot turn it back into the original. Reversible encryption means the key, or the algorithm itself, becomes the only barrier.
The record describes the impact plainly: sensitive information can be easily decrypted, and stolen credentials could then be used for arbitrary actions that corrupt the system. The medium score reflects that this needs a way to obtain the protected values first. It is not a remote code execution bug, but credentials are often reused, so the damage can travel past one appliance.
This CVE was published alongside CVE-2024-3544, a separate LoadMaster issue covered in its own post. Treat them as one maintenance window.
Quick check
Is CVE-2024-3543 exploited in the wild?
The record marks it as not on the CISA Known Exploited Vulnerabilities list, and the sources I could use do not say otherwise.
Does it let an attacker log in directly?
No. The record says attackers can decrypt passwords they obtain. Obtaining them is a separate step.
Sources
- https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543 (redirected to the Progress community site and could not be read)
- Gold entry for CVE-2024-3543
Last reviewed: 19 October 2026.
