BeyondTrust Blunder: CISA Flags Major Security Flaw in Vulnerability Catalog
CISA adds BeyondTrust software flaw to its Known Exploited Vulnerabilities catalog because nothing says ‘holiday spirit’ like a critical security patch deadline. Federal agencies must secure their networks before Santa gets stuck in the chimney—December 27, 2024, to be precise.
Hot Take:
Looks like BeyondTrust’s software had a little too much trust in its own security! With command injection flaws being the new ‘in’ thing for hackers, it’s no wonder CISA has added this to their list of ‘greatest hits’. Now it’s a race against time for federal agencies to patch things up before the hackers turn privilege into their own personal playground!
Key Points:
- The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a BeyondTrust software flaw to its Known Exploited Vulnerabilities catalog.
- The vulnerability, CVE-2024-12356, has a CVSS score of 9.8, indicating its critical nature.
- The flaw could allow unauthenticated attackers to inject commands that execute as a site user.
- All versions of BeyondTrust’s Privileged Remote Access (PRA) and Remote Support (RS) are affected, but a patch is available for versions 22.1.x and higher.
- Federal agencies must patch this vulnerability by December 27, 2024.
Already a member? Log in here