Description

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

Known Exploited

🚨 Marked as known exploited on December 19th, 2024 (6 months ago).

Classification

CVE ID: CVE-2024-12356

CVSS Base Severity: CRITICAL

CVSS Base Score: 9.8

CVSS Vector:

Affected Products

Vendor: BeyondTrust

Product: Remote Support & Privileged Remote Access

Exploit Prediction Scoring System (EPSS)

EPSS Score: 1.3% (probability of being exploited)

EPSS Percentile: 85.79% (scored less or equal to compared to others)

EPSS Date: 2025-02-04 (when was this score calculated)

References

https://www.cve.org/CVERecord?id=CVE-2024-12356
https://nvd.nist.gov/vuln/detail/CVE-2024-12356
https://www.beyondtrust.com/trust-center/security-advisories/bt24-10

Timeline