Exploit / PoCcriticalExploited in the wild

CISA Adds Second BeyondTrust Flaw to KEV Catalog Amid Active Attacks

The Hacker Newsby @TheHackersNewsJan 15, 2025 · 00:00 UTC (Jan 15, 2025)2 min read2 · 1 read

Read at thehackernews.com

Analyze CVE-2024-12686 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2024-12686 CVE-2024-12356 CVE-2023-48365

Tags: cve-2024-12686 cve-2024-12356 cve-2023-48365 exploit

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-48365	HTTP Request Smuggling/Tunneling in Qlik Sense Allows Privilege Escalation	9.9	48%	KEVRansomware	Nov 15, 2023 KEV Jan 13, 2025
CVE-2024-12356	Unauthenticated Command Injection in BeyondTrust Privileged Remote Access/Remote Support	9.8	87%	KEVPoC	Dec 17, 2024 KEV Dec 19, 2024
CVE-2024-12686	OS Command Injection in BeyondTrust Privileged Remote Access and Remote Support	7.2	32%	KEV	Dec 18, 2024 KEV Jan 13, 2025

From the original article

2 min read at thehackernews.com

 Ravie Lakshmanan  Jan 14, 2025 Vulnerability / Cybersecurity The U. S. Cybersecurity and Infrastructure Security Agency (CISA) on Monday added a second security flaw impacting BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) products to the Known Exploited Vulnerabilities ( KEV ) catalog, citing evidence of active exploitation in the wild.

The Hacker News

By @TheHackersNews · thehackernews.com

Read the full article at The Hacker News

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.