Progress Flowmon Command Injection Remote Code Execution (CVE-2024-1212)

CVE-2024-1212 is an unauthenticated command injection in Progress Flowmon network monitoring appliances. Attackers send crafted HTTP requests to the web interface and execute commands as the root user.

Affected versions

• Flowmon before 11.1.14
• Flowmon before 12.3.5
• Default or weakly protected admin interfaces on port 443

Detect exposure

curl -k -I https://flowmon.example.com/
nmap -p 443 --script http-title flowmon-subnet/24

Fix

• Upgrade to vendor-fixed Flowmon release
• Place management UI behind VPN or IP allowlist
• Rotate SNMP/API credentials stored on the appliance
• Check /var/log for curl/wget/bash spawned from web user

Post-exploitation often leads to lateral movement via stored network credentials.