CVE-2024-12686

Description

A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.

Reserved 2024-12-16 | Published 2024-12-18 | Updated 2025-01-13 | Assigner BT

CISA Known Exploited Vulnerability

Date added 2025-01-13 | Due date 2025-02-03

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Problem types

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Product status

Default status
unaffected

Any version
affected

References

nvd.nist.gov/vuln/detail/CVE-2024-12686

www.beyondtrust.com/trust-center/security-advisories/bt24-11

cve.org (CVE-2024-12686)

nvd.nist.gov (CVE-2024-12686)

Download JSON