CVE-2024-3544 is a high severity flaw (CVSS 7.5) in Progress Kemp LoadMaster. Unauthenticated attackers on the same network as a high availability or cluster member could perform actions using SSH private keys. The vendor closed it by requiring a shared secret between partners. Confirm fixed builds in the Progress advisory.
Weakness class: CWE-798.
What's affected
- Product: Progress Kemp LoadMaster, GA, LTS and LTSF branches per the record.
- Exposure: machines that are part of a high availability pair or a cluster group. The attacker needs to know the IP address of one machine in the group and have access to the same network.
- Severity: High, CVSS 7.5, per the record.
- Fixed versions: the record does not list them. It says the issue was closed by enhancing partner communications so that a shared secret must be exchanged before communication proceeds. Take the exact builds from the Progress advisory.
- Exploited in the wild: the record's KEV flag is false.
How to check if you're exposed
- Identify every LoadMaster you run in high availability or cluster mode. Single standalone units are not described as exposed by the record.
- Read the firmware version on each partner and compare it with the fixed builds in the vendor advisory.
- Check which network segments can reach the partner communication path. The described attack needs same network access, so a flat network raises the risk.
- Confirm that management and partner traffic is not reachable from user or guest networks.
What to do now
- Find the fixed build for your branch in the Progress advisory.
- Update both partners of each pair, and every cluster member, in a planned window.
- After the update, verify that partners still synchronise, since the fix adds a shared secret exchange.
- Move partner links onto an isolated network where you can.
- Review who could reach the partner network before patching, and rotate any credentials that were stored on those appliances if that review turns up doubt.
Why it matters
The class is CWE-798, use of hard-coded credentials. When the same private key ships in every unit, anyone who has seen it from one device can present it to another. The key stops being a secret and becomes a public constant that happens to be inconvenient to find.
The vendor fix changes the trust model rather than just swapping a key. Partners now have to exchange a shared secret before talking, so a stranger who knows an IP address no longer qualifies. That is the right shape of fix for this class: remove the universal credential and require something unique per pair.
Network position matters here. The attacker must be on the same network as a group member, so the practical risk depends on how flat your data center or cloud network is. Load balancers sit in front of important services, which makes even a limited foothold worth closing.
Quick check
Do standalone LoadMaster units need this fix?
The record describes exposure through machines in an HA or cluster group. Still, apply the update to all units, since fixed builds are the vendor guidance.
Is there a known exploit in the wild?
The record marks the KEV flag as false.
Sources
- https://support.kemptechnologies.com/hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3543 (redirected to the Progress community site and could not be read)
- Gold entry for CVE-2024-3544
Last reviewed: 19 October 2026.
