Loadmaster CVE-2026-3517

Exploitation requires the attacker to possess valid authentication credentials for a LoadMaster administrator account specifically granted 'Geo Administration' permissions (not just any admin account - this is a role-based access control feature). The attacker must have adjacent network access (AV:A in CVSS vector) to reach the LoadMaster management interface, meaning they must be positioned on a network segment with Layer 2/3 connectivity to the appliance's administrative network (cannot exploit from the internet unless management interfaces are exposed, which violates deployment best practices). The Geo Administration feature must be enabled and in use within the LoadMaster configuration (organizations not utilizing geolocation-based load balancing may not have this feature active). High privilege requirement (PR:H) and adjacent network constraint significantly limit exploitation scenarios compared to remote unauthenticated vulnerabilities. The vulnerability does not require user interaction (UI:N) once the attacker has obtained the necessary credentials and network position. Scope change (S:C) indicates the vulnerability can break out of the LoadMaster application context to compromise the underlying operating system or hypervisor layer, amplifying impact beyond the application itself.

Real-world risk is moderate despite the 8.4 CVSS score. The CVSS vector reveals critical constraints: AV:A (adjacent network access required, not internet-routable), PR:H (high privileges required - specifically 'Geo Administration' role), and S:C (scope change indicating container/VM escape potential). SSVC framework confirms Technical Impact as 'total' (complete system compromise) but Exploitation status as 'none' (no evidence of active exploitation) and Automatable as 'no' (requires specific credentials and adjacent network positioning). The combination of adjacent-network-only access and specialized administrative permissions creates significant barriers to mass exploitation. This is not a wormable vulnerability or drive-by internet attack scenario. Primary risk exists in environments where: (1) attackers have already compromised adjacent network segments, (2) insider threats with elevated privileges exist, or (3) credential theft has occurred targeting administrators with Geo features enabled. EPSS score unavailable but likely low given access constraints. Absence from CISA KEV suggests no widespread exploitation campaigns. Priority should be elevated for organizations using geolocation-based load balancing features and deploying LoadMaster in multi-tenant or low-trust adjacent network environments. Organizations not using Geo Administration features face reduced risk but should still patch due to total system compromise potential.

An attacker who has compromised credentials for a LoadMaster administrator account with Geo Administration permissions positions themselves on an adjacent network segment (such as a corporate LAN with access to the management VLAN or a compromised server in the same data center). The attacker authenticates to the LoadMaster API and sends a crafted request to the 'addcountry' command endpoint, embedding shell metacharacters and malicious commands within the country parameter (for example, injecting backticks or semicolons followed by commands like reverse shell payloads). Because the API fails to sanitize this input before passing it to underlying system command execution functions, the operating system executes the attacker's arbitrary commands with the privileges of the LoadMaster service (typically root or administrator equivalent). The attacker achieves complete control of the appliance, enabling data exfiltration of SSL private keys and configuration data, manipulation of traffic routing rules to intercept sensitive communications, or use of the compromised appliance as a pivot point for lateral movement into protected network segments behind the load balancer.