cvelistv5 - CVE-2024-12686

CVE-2024-12686 (GCVE-0-2024-12686)

Vulnerability from cvelistv5

Published

2024-12-18 20:23

Modified

2025-10-21 22:55

Severity ?

6.6 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

CWE-78 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

Summary

A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.

References

URL

	Vendor	Product	Version
	BeyondTrust	Remote Support(RS) & Privileged Remote Access(PRA)	Version: 0 <

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

Date added: 2025-01-13

Due date: 2025-02-03

Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Used in ransomware: Unknown

Notes: https://www.beyondtrust.com/trust-center/security-advisories/bt24-11 ; https://nvd.nist.gov/vuln/detail/CVE-2024-12686

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-12686",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-01-13T15:32:45.601180Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2025-01-13",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12686"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T22:55:34.086Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12686"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2025-01-13T00:00:00+00:00",
            "value": "CVE-2024-12686 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Remote Support(RS) \u0026 Privileged Remote Access(PRA)",
          "vendor": "BeyondTrust",
          "versions": [
            {
              "lessThanOrEqual": "24.3.1",
              "status": "affected",
              "version": "0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "datePublic": "2024-12-18T19:41:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003eA vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.\u003c/span\u003e\u003cspan style=\"background-color: rgb(255, 255, 255);\"\u003e\u0026nbsp;\u003c/span\u003e\u003cbr\u003e"
            }
          ],
          "value": "A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-88",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-88 OS Command Injection"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 6.6,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-12-18T20:23:57.909Z",
        "orgId": "13061848-ea10-403d-bd75-c83a022c2891",
        "shortName": "BT"
      },
      "references": [
        {
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12686"
        },
        {
          "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-11"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "Command Injection vulnerability in Remote Support(RS) \u0026 Privilege Remote Access (PRA)",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "13061848-ea10-403d-bd75-c83a022c2891",
    "assignerShortName": "BT",
    "cveId": "CVE-2024-12686",
    "datePublished": "2024-12-18T20:23:57.909Z",
    "dateReserved": "2024-12-16T18:58:57.921Z",
    "dateUpdated": "2025-10-21T22:55:34.086Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "cisa_known_exploited": {
      "cveID": "CVE-2024-12686",
      "cwes": "[\"CWE-78\"]",
      "dateAdded": "2025-01-13",
      "dueDate": "2025-02-03",
      "knownRansomwareCampaignUse": "Unknown",
      "notes": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-11 ; https://nvd.nist.gov/vuln/detail/CVE-2024-12686",
      "product": "Privileged Remote Access (PRA) and Remote Support (RS)",
      "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
      "shortDescription": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.",
      "vendorProject": "BeyondTrust",
      "vulnerabilityName": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-12686\",\"sourceIdentifier\":\"13061848-ea10-403d-bd75-c83a022c2891\",\"published\":\"2024-12-18T21:15:08.020\",\"lastModified\":\"2025-10-24T13:43:52.550\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.\"},{\"lang\":\"es\",\"value\":\"Se ha descubierto una vulnerabilidad en Privileged Remote Access (PRA) y Remote Support (RS) que puede permitir que un atacante con privilegios administrativos existentes inyecte comandos y se ejecute como un usuario del sitio.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"13061848-ea10-403d-bd75-c83a022c2891\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":6.6,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":0.7,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"HIGH\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.2,\"impactScore\":5.9}]},\"cisaExploitAdd\":\"2025-01-13\",\"cisaActionDue\":\"2025-02-03\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability\",\"weaknesses\":[{\"source\":\"13061848-ea10-403d-bd75-c83a022c2891\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-78\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"24.3.1\",\"matchCriteriaId\":\"D402E4B5-D3EA-4AD1-8954-92FB6A873906\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"24.3.1\",\"matchCriteriaId\":\"AD0D0CD2-E8CE-40B6-B8F0-2FB1A98DA3F8\"}]}]}],\"references\":[{\"url\":\"https://nvd.nist.gov/vuln/detail/CVE-2024-12686\",\"source\":\"13061848-ea10-403d-bd75-c83a022c2891\",\"tags\":[\"Third Party Advisory\",\"US Government Resource\"]},{\"url\":\"https://www.beyondtrust.com/trust-center/security-advisories/bt24-11\",\"source\":\"13061848-ea10-403d-bd75-c83a022c2891\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12686\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"US Government Resource\"]}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"affected\": [{\"defaultStatus\": \"unaffected\", \"product\": \"Remote Support(RS) \u0026 Privileged Remote Access(PRA)\", \"vendor\": \"BeyondTrust\", \"versions\": [{\"lessThanOrEqual\": \"24.3.1\", \"status\": \"affected\", \"version\": \"0\", \"versionType\": \"custom\"}]}], \"datePublic\": \"2024-12-18T19:41:00.000Z\", \"descriptions\": [{\"lang\": \"en\", \"supportingMedia\": [{\"base64\": false, \"type\": \"text/html\", \"value\": \"\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003eA vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.\u003c/span\u003e\u003cspan style=\\\"background-color: rgb(255, 255, 255);\\\"\u003e\u0026nbsp;\u003c/span\u003e\u003cbr\u003e\"}], \"value\": \"A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.\"}], \"impacts\": [{\"capecId\": \"CAPEC-88\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-88 OS Command Injection\"}]}], \"metrics\": [{\"cvssV3_1\": {\"attackComplexity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"availabilityImpact\": \"HIGH\", \"baseScore\": 6.6, \"baseSeverity\": \"MEDIUM\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"HIGH\", \"privilegesRequired\": \"HIGH\", \"scope\": \"UNCHANGED\", \"userInteraction\": \"NONE\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H\", \"version\": \"3.1\"}, \"format\": \"CVSS\", \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-78\", \"description\": \"CWE-78 Improper Neutralization of Special Elements used in an OS Command (\u0027OS Command Injection\u0027)\", \"lang\": \"en\", \"type\": \"CWE\"}]}], \"providerMetadata\": {\"orgId\": \"13061848-ea10-403d-bd75-c83a022c2891\", \"shortName\": \"BT\", \"dateUpdated\": \"2024-12-18T20:23:57.909Z\"}, \"references\": [{\"url\": \"https://nvd.nist.gov/vuln/detail/CVE-2024-12686\"}, {\"url\": \"https://www.beyondtrust.com/trust-center/security-advisories/bt24-11\"}], \"source\": {\"discovery\": \"UNKNOWN\"}, \"title\": \"Command Injection vulnerability in Remote Support(RS) \u0026 Privilege Remote Access (PRA)\", \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}}, \"adp\": [{\"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-12686\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"active\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"total\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-01-13T15:32:45.601180Z\"}}}, {\"other\": {\"type\": \"kev\", \"content\": {\"dateAdded\": \"2025-01-13\", \"reference\": \"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12686\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-12-18T21:15:04.572Z\"}, \"timeline\": [{\"time\": \"2025-01-13T00:00:00+00:00\", \"lang\": \"en\", \"value\": \"CVE-2024-12686 added to CISA KEV\"}], \"title\": \"CISA ADP Vulnrichment\"}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-12686\", \"assignerOrgId\": \"13061848-ea10-403d-bd75-c83a022c2891\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"BT\", \"dateReserved\": \"2024-12-16T18:58:57.921Z\", \"datePublished\": \"2024-12-18T20:23:57.909Z\", \"dateUpdated\": \"2025-07-30T01:25:39.889Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

wid-sec-w-2024-3726

Vulnerability from csaf_certbund

Published

2024-12-18 23:00

Modified

2025-01-13 23:00

Summary

BeyondTrust Privileged Remote Access: Schwachstelle ermöglicht Ausführen von beliebigen Kommandos

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung

BeyondTrust Privileged Remote Access (PRA) bietet privilegierten Benutzern und externen Anbietern sicheren, überwachten Zugriff auf kritische Systeme und IT-Infrastrukturen. BeyondTrust Remote Support (RS) ermöglicht IT-Teams und Dienstleistern sicheren, interaktiven Fernzugriff zur Unterstützung von Endbenutzern

Angriff

Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in BeyondTrust Privileged Remote Access und BeyondTrust Remote Support ausnutzen, um beliebige Kommandos auszuführen.

Betroffene Betriebssysteme

- Linux - Windows

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "BeyondTrust Privileged Remote Access (PRA) bietet privilegierten Benutzern und externen Anbietern sicheren, \u00fcberwachten Zugriff auf kritische Systeme und IT-Infrastrukturen.\r\nBeyondTrust Remote Support (RS) erm\u00f6glicht IT-Teams und Dienstleistern sicheren, interaktiven Fernzugriff zur Unterst\u00fctzung von Endbenutzern",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in BeyondTrust Privileged Remote Access und BeyondTrust Remote Support ausnutzen, um beliebige Kommandos auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Linux\n- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2024-3726 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3726.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2024-3726 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-3726"
      },
      {
        "category": "external",
        "summary": "BeyondTrust Advisory BT24-11 vom 2024-12-18",
        "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-11"
      },
      {
        "category": "external",
        "summary": "GitHub Database",
        "url": "https://github.com/advisories/GHSA-xqg3-vx4p-jmwm"
      },
      {
        "category": "external",
        "summary": "CISA Known Exploited Vulnerabilities Catalog vom 2025-01-13",
        "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog"
      }
    ],
    "source_lang": "en-US",
    "title": "BeyondTrust Privileged Remote Access: Schwachstelle erm\u00f6glicht Ausf\u00fchren von beliebigen Kommandos",
    "tracking": {
      "current_release_date": "2025-01-13T23:00:00.000+00:00",
      "generator": {
        "date": "2025-01-14T09:03:14.154+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.10"
        }
      },
      "id": "WID-SEC-W-2024-3726",
      "initial_release_date": "2024-12-18T23:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2024-12-18T23:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2025-01-13T23:00:00.000+00:00",
          "number": "2",
          "summary": "Aktive Ausnutzung gemeldet"
        }
      ],
      "status": "final",
      "version": "2"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=24.3.1",
                "product": {
                  "name": "BeyondTrust Privileged Remote Access \u003c=24.3.1",
                  "product_id": "T039916"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=24.3.1",
                "product": {
                  "name": "BeyondTrust Privileged Remote Access \u003c=24.3.1",
                  "product_id": "T039916-fixed"
                }
              }
            ],
            "category": "product_name",
            "name": "Privileged Remote Access"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "\u003c=24.3.1",
                "product": {
                  "name": "BeyondTrust Remote Support \u003c=24.3.1",
                  "product_id": "T039917"
                }
              },
              {
                "category": "product_version_range",
                "name": "\u003c=24.3.1",
                "product": {
                  "name": "BeyondTrust Remote Support \u003c=24.3.1",
                  "product_id": "T039917-fixed"
                }
              }
            ],
            "category": "product_name",
            "name": "Remote Support"
          }
        ],
        "category": "vendor",
        "name": "BeyondTrust"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-12686",
      "notes": [
        {
          "category": "description",
          "text": "Es gibt eine Schwachstelle in BeyondTrust Privileged Remote Access und BeyondTrust Remote Support. Diese besteht aufgrund einer Command Injection. Ein entfernter, authentifizierter Angreifer, der \u00fcber Administratorrechte zum Hochladen einer Datei verf\u00fcgt, kann diese Schwachstelle ausnutzen, um im Kontext des Site-Benutzers beliebige Befehle im zugrunde liegenden Betriebssystem auszuf\u00fchren."
        }
      ],
      "product_status": {
        "last_affected": [
          "T039917",
          "T039916"
        ]
      },
      "release_date": "2024-12-18T23:00:00.000+00:00",
      "title": "CVE-2024-12686"
    }
  ]
}

ghsa-xqg3-vx4p-jmwm

Vulnerability from github

Published

2024-12-18 21:30

Modified

2025-10-22 00:33

Severity ?

6.6 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-12686"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-78"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-12-18T21:15:08Z",
    "severity": "MODERATE"
  },
  "details": "A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user.",
  "id": "GHSA-xqg3-vx4p-jmwm",
  "modified": "2025-10-22T00:33:11Z",
  "published": "2024-12-18T21:30:56Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12686"
    },
    {
      "type": "WEB",
      "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-11"
    },
    {
      "type": "WEB",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12686"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

fkie_cve-2024-12686

Vulnerability from fkie_nvd

Published

2024-12-18 21:15

Modified

2025-10-24 13:43

Severity ?

6.6 (Medium) - CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
7.2 (High) - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Summary

References

URL	Tags
13061848-ea10-403d-bd75-c83a022c2891	https://nvd.nist.gov/vuln/detail/CVE-2024-12686	Third Party Advisory, US Government Resource
13061848-ea10-403d-bd75-c83a022c2891	https://www.beyondtrust.com/trust-center/security-advisories/bt24-11	Vendor Advisory
134c704f-9b21-4f2e-91b3-4a467353bcc0	https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12686	US Government Resource

Impacted products

	Vendor	Product	Version
	beyondtrust	privileged_remote_access	*
	beyondtrust	remote_support	*

JSON

To clipboard

{
  "cisaActionDue": "2025-02-03",
  "cisaExploitAdd": "2025-01-13",
  "cisaRequiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.",
  "cisaVulnerabilityName": "BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) OS Command Injection Vulnerability",
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:beyondtrust:privileged_remote_access:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "D402E4B5-D3EA-4AD1-8954-92FB6A873906",
              "versionEndIncluding": "24.3.1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:beyondtrust:remote_support:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "AD0D0CD2-E8CE-40B6-B8F0-2FB1A98DA3F8",
              "versionEndIncluding": "24.3.1",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) which can allow an attacker with existing administrative privileges to inject commands and run as a site user."
    },
    {
      "lang": "es",
      "value": "Se ha descubierto una vulnerabilidad en Privileged Remote Access (PRA) y Remote Support (RS) que puede permitir que un atacante con privilegios administrativos existentes inyecte comandos y se ejecute como un usuario del sitio."
    }
  ],
  "id": "CVE-2024-12686",
  "lastModified": "2025-10-24T13:43:52.550",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "HIGH",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 6.6,
          "baseSeverity": "MEDIUM",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 0.7,
        "impactScore": 5.9,
        "source": "13061848-ea10-403d-bd75-c83a022c2891",
        "type": "Secondary"
      },
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.2,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "HIGH",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 1.2,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2024-12-18T21:15:08.020",
  "references": [
    {
      "source": "13061848-ea10-403d-bd75-c83a022c2891",
      "tags": [
        "Third Party Advisory",
        "US Government Resource"
      ],
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-12686"
    },
    {
      "source": "13061848-ea10-403d-bd75-c83a022c2891",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "https://www.beyondtrust.com/trust-center/security-advisories/bt24-11"
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "tags": [
        "US Government Resource"
      ],
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12686"
    }
  ],
  "sourceIdentifier": "13061848-ea10-403d-bd75-c83a022c2891",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "13061848-ea10-403d-bd75-c83a022c2891",
      "type": "Secondary"
    },
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-78"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CVE-2024-12686 (GCVE-0-2024-12686)

Vulnerability from cvelistv5

CISA Known Exploited Vulnerability

Data from the CISA Known Exploited Vulnerabilities Catalog

wid-sec-w-2024-3726

Vulnerability from csaf_certbund

ghsa-xqg3-vx4p-jmwm

Vulnerability from github

fkie_cve-2024-12686

Vulnerability from fkie_nvd

Tags

Sightings

Nomenclature