Summary
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
- Vendor
- BeyondTrust
- Product
- Privileged Remote Access (PRA) and Remote Support (RS)
- Added to KEV
- Jan 13, 2025
- Remediation due
- Feb 3, 2025 (US federal deadline)
- Ransomware use
- Not known
- Weakness
- CWE-78
- EPSS
- 32.6% as of Nov 12
In the news
- No Asia-Pacific article names this CVE yet.
Linked
Actors named alongside it:
none
Incidents exploiting it:
- none recorded
References