Command Injection Vulnerability in Remote Support (RS) & Privileged Remote Access (PRA) (CVE-2024-12356)

What is affected, what to do

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

The vulnerability is being actively exploited; treat it as a priority. The available sources name no fixed version. Check the vendor guidance in the references below. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• BeyondTrust Remote Support lte *..24.3.1
• BeyondTrust Privileged Remote Access lte *..24.3.1

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Build an inventory: Identify every on-premises BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) appliance, physical or virtual. Check the installed version via the /appliance interface. The context lists 24.3.1 as affected; treat older releases as affected until the vendor advisory says otherwise.
   • Apply the patch: A patch is available from the vendor — look up the exact version in the vendor advisory. Install it via the /appliance interface or the BeyondTrust customer portal. For SaaS instances, get written confirmation from the vendor that your instance has been updated.
   • Cut exposure: If you cannot patch within hours, restrict access to the appliance web interface (typically TCP 443) to known source ranges. Alternatively, take the appliance offline temporarily and arrange an alternative emergency remote-access path.
   • Check for compromise before returning to service: Preserve appliance logs (session, audit and configuration changes) going back to at least early December 2024. Hunt for unknown users, API accounts and newly registered Jump Clients.
   • Rotate secrets: Rotate API keys, integration credentials (LDAP/SAML bind accounts), vault credentials and local admin passwords stored on the appliance. The appliance brokers privileged access — if in doubt, assume those secrets were exfiltrated.
   • Check reporting duties: If compromise is suspected, trigger your NIS2/KRITIS reporting process (24 h early warning to the BSI/national CSIRT).
2. 02

   Runbook step 2

   Mitigation layers

   • Network segmentation: Run the appliance in a dedicated DMZ. Allow outbound traffic from the appliance only to defined destinations (Jump Client networks, vendor update servers) and default-deny everything else. This frustrates reverse shells and data exfiltration.
   • Front-door access control: Put the representative/admin interfaces (/login, /appliance) behind VPN or ZTNA with MFA. Expose only the customer-facing portal functions that genuinely need to be public, and geo/IP-restrict those where possible.
   • WAF/IPS: Place a reverse proxy/WAF in front of the appliance. Block or alert on requests and WebSocket upgrades carrying shell metacharacters (;, |, `, $(, &&) in parameters or handshake fields. Enable vendor IPS signatures for CVE-2024-12356 where available.
   • IAM/least privilege: Scope Jump Client groups and session policies so that a compromised site account cannot reach every endpoint. For tier-0 assets (domain controllers, OT engineering workstations), additionally require session approval by a second person.
   • Endpoint hardening: On hosts with Jump Clients, use an EDR rule to prevent the Jump Client process from spawning script interpreters outside an approved, active session.
   • Configuration: Disable unused API accounts and integrations. Enable syslog forwarding from the appliance to the SIEM if it is not already on.
3. 03

   Runbook step 3

   Detection rules

   • Network telemetry (Zeek/Suricata/firewall): Alert on new outbound connections from the appliance IP to non-allowlisted destinations, especially on non-standard ports. KQL example: CommonSecurityLog | where SourceIP == "<appliance_ip>" and DestinationIP !in (allowlist) | summarize count() by DestinationIP, DestinationPort
   • Appliance audit log via syslog: Creation of new local users or API accounts, permission changes and password resets outside change windows. Sigma shape: logsource: beyondtrust_syslog; selection: event in ('user_created','api_account_created','permission_changed'); condition: selection and not change_window.
   • Web access logs (reverse proxy/WAF): Unusual WebSocket upgrade requests from unknown source IPs, and requests containing encoded shell metacharacters (%3B, %7C, %60, %24%28). Also watch for bursts of error responses immediately preceding successful requests, which indicate exploit probing.
   • Endpoint EDR/Sysmon EID 1: Process chains where the Jump Client is the parent and cmd.exe, powershell.exe, rundll32.exe or certutil.exe is the child, particularly with no corresponding logged session. SPL: index=sysmon EventCode=1 ParentImage="*bomgar-scc*" (Image="*\\powershell.exe" OR Image="*\\cmd.exe") | stats count by host, CommandLine
   • Session correlation: Remote sessions at odd hours, to unusual targets or by unfamiliar representative accounts. Reconcile appliance session reports against endpoint logon events (Windows Event ID 4624, logon type 10/3).

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.

Source: pwn.watch, NVD (NIST), cvelistv5, CISA KEV Catalog, CVE.org (MITRE), CSA/SingCERT

Vendors and products

• BeyondTrust BeyondTrust Privileged Remote Access
• BeyondTrust BeyondTrust Remote Support

Weakness classes (CWE)

• CWE-77Improper Neutralization of Special Elements used in a Command ('Command Injection')

  Class

  The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component.

  Entry at MITRE CWE-77

References & sources

• CVE.org (MITRE)CVERecord?id=CVE-2024-12356Third-party advisory, US government resource
• NVD (NIST)NVD: CVE-2024-12356Third-party advisory, US government resource, pwn-watch
• beyondtrust.comBT24-10: command injection in Remote Support and Privileged Remote AccessVendor advisory, pwn-watch
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2024-12356government-resource, US government resource
• attackerkb.comtopics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysisExploit, Third-party advisory
• pwn.watchpwn.watch: BeyondTrust Remote Support breach reaches US Treasury (CVE-2024-12356)pwn-watch
• beyondtrust.comRemote Support SaaS service security investigationpwn-watch
• s3.documentcloud.orgTreasury letter to the Senate Banking Committee on the December 2024 cyberattackpwn-watch
• bleepingcomputer.comUS Treasury Department breached through remote support platformpwn-watch
• cisa.govCISA Known Exploited Vulnerabilities Catalogpwn-watch