CVE-2024-12356

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-12356
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

9.8 /10

CVSS v3.0 : CRITICAL

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis Exploit Third Party Advisory
https://nvd.nist.gov/vuln/detail/CVE-2024-12356 Third Party Advisory US Government Resource
https://www.beyondtrust.com/trust-center/security-advisories/bt24-10 Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2024-12356 Third Party Advisory US Government Resource
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*
cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
History

07 Mar 2025, 22:07

Type Values Removed Values Added
References () https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis - () https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis - Exploit, Third Party Advisory

17 Feb 2025, 21:15

Type Values Removed Values Added
References
  • () https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis -

20 Dec 2024, 15:25

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 9.8
First Time Beyondtrust
Beyondtrust remote Support
Beyondtrust privileged Remote Access
CWE CWE-77
CPE cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*
cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*
References () https://www.beyondtrust.com/trust-center/security-advisories/bt24-10 - () https://www.beyondtrust.com/trust-center/security-advisories/bt24-10 - Vendor Advisory
References () https://nvd.nist.gov/vuln/detail/CVE-2024-12356 - () https://nvd.nist.gov/vuln/detail/CVE-2024-12356 - Third Party Advisory, US Government Resource
References () https://www.cve.org/CVERecord?id=CVE-2024-12356 - () https://www.cve.org/CVERecord?id=CVE-2024-12356 - Third Party Advisory, US Government Resource

17 Dec 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-12-17 05:15

Updated : 2025-03-07 22:07

NVD link : CVE-2024-12356

Mitre link : CVE-2024-12356

JSON object : View

Products Affected

beyondtrust

  • remote_support
  • privileged_remote_access
CWE
CWE-77

Improper Neutralization of Special Elements used in a Command ('Command Injection')