Actively exploited · Published Dec 17, 2024 · Assigned by BT
CVE-2024-12356Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
Critical 9.8 Exploited
In plain English
A critical-severity command injection in Privileged Remote Access from BeyondTrust. Attackers are actively exploiting it in the wild (listed by CISA on December 19, 2024). The chance it is exploited in the next 30 days is estimated at 87.4% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
CISA guidance
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Federal agencies must remediate by Dec 27, 2024.
Official description
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| BeyondTrust | Remote Support | 0 – through 24.3.1 |
| BeyondTrust | Privileged Remote Access | 0 – through 24.3.1 |
Weakness: CWE-77 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://www.cve.org/CVERecord?id=CVE-2024-12356
- https://nvd.nist.gov/vuln/detail/CVE-2024-12356
- https://www.beyondtrust.com/trust-center/security-advisories/bt24-10
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12356 government-resource
- https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis