medium6.6Known exploited
CVE-2024-12686
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2025-01-13. Federal due date: 2025-02-03.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Impact
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Beyondtrust | Privileged Remote Access | through 24.3.1 |
| Beyondtrust | Remote Support | through 24.3.1 |