CISA Known Exploited Vulnerability (KEV)
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability
January 13, 2025
February 3, 2025
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.
References
Weakness Enumeration
| CWE-ID | CWE Name |
|---|---|
|
CWE-78 |
Improper Neutralization of Special Elements used in an OS Command (‘OS Command Injection’) |