Phoenix
Sigma IntelligenceBeta
Emerging Threats
CVE2024

CVE-2024-1212

1Rules
2References
1Folders
2024-03-20Latest
Summary

CVE-2024-1212 is tracked here through 1 Sigma detection for exploitation attempts and related post-exploitation behavior observed in 2024. Coverage centers on webserver.

Related Detections
Search this threat
Emerging Threathightest

CVE-2024-1212 Exploitation - Progress Kemp LoadMaster Unauthenticated Command Injection

Detects potential exploitation of CVE-2024-1709 an unauthenticated command injection in Progress Kemp LoadMaster. It looks for GET requests to '/access/set' API with the parameters 'param=enableapi' and 'value=1' as well as an "Authorization" header with a base64 encoded value with an uncommon character.

Web Server Log
TA0001 · Initial Accesscve.2024-1212detection.emerging-threats
Nasreddine Bencherchali (Nextron Systems)Wed Mar 202024
References
1
Resolving title…
github.com
2
Resolving title…
rhinosecuritylabs.com