CVE-2024-12356

Name of the Vulnerable Software and Affected Versions BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions up to 24.3.1

Description A critical command injection vulnerability has been discovered in BeyondTrust's Privileged Remote Access (PRA) and Remote Support (RS) products. This vulnerability can allow an unauthenticated attacker to inject commands that are run as a site user, potentially leading to remote code execution. The vulnerability is being actively exploited in the wild, with reports of Chinese hackers targeting exposed systems. It is estimated that over 8,600 BeyondTrust systems remain exposed online, with 72% of them located in the US. The vulnerability has been used in real-world incidents, including a breach of the US Treasury Department.

Recommendations For BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions up to 24.3.1, apply the patch to prevent remote code execution risks. For on-premise systems, upgrade to at least 22.1.x before applying the patch to protect against the vulnerability. As a temporary workaround, consider restricting access to the vulnerable module to minimize the risk of exploitation.