CISA Known Exploited Vulnerability (KEV)
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability
December 19, 2024
December 27, 2024
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Description
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
References
Weakness Enumeration
| CWE-ID | CWE Name |
|---|---|
|
CWE-77 |
Improper Neutralization of Special Elements used in a Command (‘Command Injection’) |