BaseFortify

Publication date: 2024-12-17

Last updated on: 2025-10-24

Assigner: BeyondTrust

Description

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2024-12-17

Last Modified

2025-10-24

Generated

2026-10-23

AI Q&A

2024-12-17

EPSS Evaluated

2026-10-20

NVD

CVE-2024-12356

Affected Vendors & Products

Vendor	Product	Version / Range
beyondtrust	privileged_remote_access	to 24.3.1 (inc)
beyondtrust	remote_support	to 24.3.1 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-77	The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

Attack-Flow Graph

Executive Summary

This vulnerability, identified as CVE-2024-12356, is a serious issue found in certain remote access and support products. It allows an attacker, who does not need to be authenticated, to send harmful commands that can be executed as if they were a legitimate user of the site.

Impact Analysis

If you use the affected remote access or support products, this vulnerability could allow attackers to take control of your system or data without your permission. This could lead to unauthorized access, data breaches, or other harmful actions.

Hi! I’m here to help you understand CVE-2024-12356. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70