A function called escape_quotes() was meant to sanitise user input before passing it to a shell command. It allocated a memory buffer (a reserved block of storage for temporary data) without clearing it, and never wrote a null terminator (a marker character that tells the system "the string ends here"). Without that marker, the system reads past the sanitised input into adjacent memory — which an attacker can pre-load with a command injection payload (malicious commands disguised as ordinary input).

The attacker sends a JSON request to the /accessv2 endpoint, embedding a crafted apiuser value alongside dozens of extra keys each carrying the command to execute. The system sanitises the first value, keeps reading past it, and executes the attacker's commands as root. No credentials needed at any point.

Look for unusual POST requests to /accessv2 with abnormally large JSON bodies or unexpected key counts. Monitor for root-level process spawning triggered by the LoadMaster process. Alert on any shell commands initiated from the LoadMaster API service.

1. Upgrade to GA v7.2.63.2 or LTSF v7.2.54.18 immediately.
2. If patching is not immediately possible, restrict API access to trusted IP ranges at the firewall.
3. Review LoadMaster API access logs for anomalous requests sent before the patch was applied.

The API endpoints on LoadMaster failed to sanitise (properly clean and validate) inputs before passing them to underlying system commands. Think of it like a form on a website that accepts your name and then passes whatever you type directly into a command the server runs — if you type a name followed by a system instruction, both get executed. Progress released a fix in June.

An attacker sends a crafted HTTP request to one of the affected API endpoints with a payload (a string of commands) embedded where the application expects clean data. Because no authentication is required and the input is not validated, the server executes the attacker's commands with the privileges of the LoadMaster process. From there, the attacker can read files, install backdoors (hidden persistent access points), or move laterally (pivot from the compromised appliance to other systems on the same network).

Look for unexpected outbound connections from LoadMaster appliances, particularly to unfamiliar external IPs. Review API access logs for malformed or unusually long input values in command endpoints. Check for new or modified files in system directories, and audit running processes for anything spawned by the LoadMaster service that should not be there.

1. Upgrade to GA v7.2.63.2 or LTSF v7.2.54.18 or later immediately — a patch has been available since June.
2. Restrict access to the LoadMaster management interface so it is not reachable from the public internet.
3. Monitor outbound traffic from LoadMaster appliances and alert on any connections to external hosts not in your approved list.