LoadMaster Reversible Password Encryption Algorithm

published 2024-05-02 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-32129

cvss: 6.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.3%; EPSS 0.3% chance of exploitation in 30 days, percentile 20%
public exploits: 0; none known

Use of reversible password encryption algorithm allows attackers to decrypt passwords. Sensitive information can be easily unencrypted by the attacker, stolen credentials can be used for arbitrary actions to corrupt the system.

Patch / fix

fixed in 2

Progress Software Corporation LoadMaster 7.2.48.12, 7.2.54.10, 7.2.59.4
kemptechnologies loadmaster 7.2.48.12, 7.2.54.10, 7.5.59.4

CISA SSVC

Exploitation: none
Automatable: no
Technical impact: total
Assessed: 2 y ago (2024-05-02)

Exploit prediction

0.28% chance of exploitation in the next 30 days, higher than 20% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
CNA	3.1	6.4	CVSS:3.1/AV:A/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
NVD	3.1	7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected products

Progress Software Corporation LoadMaster
kemptechnologies loadmaster

Classification

Weakness

CWE-257 Storing Passwords in a Recoverable Format
CWE-522 Insufficiently Protected Credentials

References

support.kemptechnologies.com /hc/en-us/articles/25724813518605-ECS-Connection-Manager-Security-Vulnerabilities-CVE-2024-3544-and-CVE-2024-3
vendor-advisory, product
kemptechnologies.com /
product

Sources

CVE List CVE-2024-3543
NVD CVE-2024-3543

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary