Loadmaster CVE-2026-4048

Authenticated administrator account with 'All' permissions on the LoadMaster appliance. Adjacent network access (AV:A) to the management interface, meaning attacker must be on the same network segment - achievable through VPN access with stolen admin credentials, internal network compromise, or physical presence on corporate networks. The vulnerable file upload functionality for custom WAF rules must be accessible to the authenticated user, which is the default configuration for accounts with 'All' permissions. These prerequisites significantly limit exploitation to scenarios involving credential compromise or insider threats rather than opportunistic internet-based attacks. The High Privilege requirement (PR:H) is the primary limiting factor - this is not exploitable by low-privilege or unauthenticated attackers.

Real-world risk is moderate-to-high but constrained by strict prerequisites. CVSS 8.4 (High) reflects severe potential impact with scope change (S:C), meaning compromise extends beyond the vulnerable component to underlying OS and potentially other network segments. However, exploitation requires PR:H (high privileges) - specifically an authenticated administrator account with 'All' permissions, which represents the highest privilege tier in LoadMaster. The AV:A (adjacent network) vector requires network proximity to the management interface, reducing internet-scale exposure compared to AV:N vulnerabilities. Attack complexity is low (AC:L) with no user interaction (UI:N), meaning once an attacker has the required admin credentials and network access, exploitation is straightforward. The absence of EPSS data and KEV listing suggests no confirmed widespread or active exploitation. However, the combination of command injection primitive, high-privilege admin access, and ADC deployment context (often protecting critical applications) makes this a priority for organizations using affected products. The Changed scope is particularly concerning - successful exploitation provides OS-level access that could pivot to backend protected resources. Primary risk is from insider threats, credential compromise of admin accounts, or attackers who have already established initial access and are escalating privileges. This is NOT a pre-authentication remote vulnerability despite the RCE classification.

An attacker who has compromised credentials for a LoadMaster administrator account with 'All' permissions (through phishing, credential stuffing, or insider access) connects to the management interface from the adjacent network. They navigate to the WAF rule configuration UI and upload a specially crafted WAF rule file containing embedded OS commands such as reverse shell payloads or SSH key injection directives. The LoadMaster appliance processes the file without sanitizing the malicious input, executing the attacker's commands with the privileges of the web application process (likely root or administrative equivalent on the appliance OS). The attacker establishes persistent access, exfiltrates SSL/TLS private keys protecting backend applications, or pivots to backend servers that the LoadMaster is configured to protect.