Descripción
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
Acción recomendada
Aplicar las mitigaciones del fabricante; si no están disponibles, discontinuar el uso del producto.
Referencias
- Aviso de beyondtrust.com beyondtrust.com/trust-center/security-advisories/bt24-11
- Ficha en NVD (NIST) nvd.nist.gov/vuln/detail/CVE-2024-12686
Otras vulnerabilidades de BeyondTrust en el catálogo
- CVE-2026-102764 Vulnerabilidad de omisión de autenticación mediante suplantación (spoofing) en BeyondTrust Remote Support Alta 16-10-2026
- CVE-2026-1731 Vulnerabilidad de inyección de comandos del sistema operativo en BeyondTrust Remote Support (RS) y Privileged Remote Access (PRA) Alta 13-02-2026
- CVE-2024-12356 BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) Command Injection Vulnerability Alta 19-12-2024