BlackTreeIndependent security intelligenceBeyondTrust · Privileged Remote Access (PRA) and Remote Support (RS)
CISA confirms exploitation in the wild and lists 2025-02-03 as the remediation due date.
CISA confirms exploitation in the wild and lists 2025-02-03 as the remediation due date.
Fix not verifiedBeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
Untrusted input is incorporated into an operating-system command without safe parameter handling.
An attacker operating through a network path may attempt exploitation with elevated privileges. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) contain an OS command injection vulnerability that can be exploited by an attacker with existing administrative privileges to upload a malicious file. Successful exploitation of this vulnerability can allow a remote attacker to execute underlying operating system commands within the context of the site user.
Untrusted input is incorporated into an operating-system command without safe parameter handling.
An attacker operating through a network path may attempt exploitation with elevated privileges. If successful, the issue may cause the confidentiality, integrity or availability impact described by the vendor.
CVSS severity, EPSS forecast probability, public exploit material and CISA-confirmed exploitation are separate signals.
CISA added this CVE to its Known Exploited Vulnerabilities catalogue on 2025-01-13.
No exploit-tagged reference or CISA SSVC proof-of-concept state is currently recorded. Research may still exist outside the structured feeds.
CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection'). The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:HCommon Vulnerability Scoring System 3.1: the compact vector below is decoded into plain language.
Operational remediation based on structured source evidence.
Published 18 Dec 2024 · Last source change 21 Oct 2025, 22:55 UTC · CWE-78 · Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Core structured fields are present and their contributing authorities are shown above.
No material field changes have been recorded since change tracking began. Routine source refreshes and cosmetic edits are intentionally excluded.