CVE-2024-12356

Description

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

Reserved 2024-12-08 | Published 2024-12-17 | Updated 2024-12-19 | Assigner BT

CISA Known Exploited Vulnerability

Date added 2024-12-19 | Due date 2024-12-27

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Problem types

CWE-77 Improper Neutralization of Special Elements used in a Command ('Command Injection')

Product status

Default status
unaffected

Any version
affected

References

www.cve.org/CVERecord?id=CVE-2024-12356

nvd.nist.gov/vuln/detail/CVE-2024-12356

www.beyondtrust.com/trust-center/security-advisories/bt24-10

cve.org (CVE-2024-12356)

nvd.nist.gov (CVE-2024-12356)

Download JSON