CVE-2024-12356
Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
CVSS Score
9.8
EPSS Score
0.0%
EPSS Percentile
0th
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
| CWE | CWE-77 |
| Vendor | beyondtrust |
| Product | remote support |
| Published | Dec 17, 2024 |
| Last Updated | Oct 21, 2025 |
⚠️ Actively Exploited — Act Now
Get instant alerts for beyondtrust remote support
This vulnerability is actively exploited in the wild. Set up free real-time alerts so you're first to know about threats like CVE-2024-12356.
Get Free Alerts →
Free · No credit card · 60 sec setup
CVSS v3 Breakdown
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
Affected Versions
BeyondTrust / Remote Support
0 ≤ 24.3.1
BeyondTrust / Privileged Remote Access
0 ≤ 24.3.1
References
cve.org: https://www.cve.org/CVERecord?id=CVE-2024-12356 nvd.nist.gov: https://nvd.nist.gov/vuln/detail/CVE-2024-12356 beyondtrust.com: https://www.beyondtrust.com/trust-center/security-advisories/bt24-10 cisa.gov: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12356 attackerkb.com: https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis