Latest BeyondTrust vulnerability (CVE-2024-12356) #

BeyondTrust disclosed that affects their Privileged Remote Access (PRA) and Remote Support (RS) appliances. This has also been added to the CISA KEV as it has been exploited in the wild.

  • CVE-2024-12356 is rated highly-critical with a CVSS score of 9.8. Successful exploitation of this vulnerability would allow an attacker execute arbitrary commands on the appliance.

What is the impact? #

The issue impacts PRA and RS versions 24.3.1 and earlier.

Are updates or workarounds available? #

BeyondTrust has released a patch for all supported iterations of PRA and RS versions 22.1.x and higher and has applied the patch to cloud customers earlier this week.

How do I find potentially vulnerable systems with runZero? #

From the Services Inventory, use the following query to locate systems running potentially vulnerable software:

vendor:BeyondTrust or http.body:BeyondTrust

From the Assets Inventory, use the following query to locate systems running potentially vulnerable software:

os:BeyondTrust OR hw:BeyondTrust OR os:Bomgar OR hw:Bomgar

Written by Blain Smith

Blain Smith is a Security Research Engineer at runZero. He spent most of his career in cloud and distributed systems for AAA gaming, entertainment, and networking working on some of the most popular games and systems millions of people play and watch daily. He has given numerous talks at conferences such as TEDx, GopherCon, and P99CONF. His shift into infosec has afforded him the ability to apply his distributed systems and networking knowledge to other industries such as IoT and OT.

More about Blain Smith
Subscribe Now

Get the latest news and expert insights delivered in your inbox.

Welcome to the club! Your subscription to our newsletter is successful.

See Results in Minutes

See & secure your total attack surface. Even the unknowns & unmanageable.

Discover the new era of exposure management!