BeyondTrust · Privileged Remote Access (PRA) and Remote Support (RS)
CVE-2024-12356
Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
De quoi s'agit-il
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
CISA: BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain a command injection vulnerability, which can allow an unauthenticated attacker to inject commands that are run as a site user.
Que faire
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Échéance pour les agences fédérales américaines : 27 décembre 2024
Autres failles exploitées chez BeyondTrust
| Ajouté | Faille | Produit | Gravité | Risque d'attaque |
|---|---|---|---|---|
| 13 janv. 2025 | OS Command Injection | Privileged Remote Access (PRA) and Remote Support (RS) | Moyenne 6,6 | 32% |
| 16 oct. 2026 | Authentication Bypass by Spoofing | Remote Support | Critique 9,3 | 19% |
| 13 févr. 2026 | OS Command Injection | Remote Support (RS) and Privileged Remote Access (PRA) | Critique 9,9 | 93% |
Sources : Known Exploited Vulnerabilities (CISA, domaine public), CVE records (cve.org) et EPSS (FIRST). Le risque d'attaque est l'estimation EPSS qu'une personne tente d'exploiter la faille dans les 30 prochains jours.