LoadMaster EUVD-2026-49185

The Geo Location management interface must be enabled and accessible. The attacker must possess valid high-privilege credentials (administrator or equivalent) to the appliance. Network adjacency is required-the attack cannot be launched from outside the management network unless the management interface is exposed.

The CVSS 3.1 score is 8.4, with a vector of AV:A/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H indicating an adjacent network attack vector, low complexity, high privileges required, no user interaction, changed scope, and high confidentiality, integrity, and availability impact. EPSS exploitation probability is not available, and the vulnerability is not listed in CISA KEV nor accompanied by public proof-of-concept code. From an SSVC perspective, exploitation is none at present, but the exploit is automatable given low complexity and the technical impact is total. Real-world risk is moderate because while impact is critical, the required adjacency and high privileges limit the attack surface. The risk is not merely a high-CVSS theoretical issue but its exploitation depends on an already compromised high-privilege account and network adjacency to the management network.

An attacker who has obtained high-privilege credentials (e.g., administrator) to the LoadMaster management interface and is positioned on the adjacent network sends a crafted request to the Geo Location configuration endpoints. The injected operating system command executes with the appliance's underlying OS privileges, granting the attacker full control over the system.