Remote Support and Privileged Remote Access
CVE-2024-12356: Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA)
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
Published
Automatic summary from the vendor's CVE record. We haven't written a full analysis of this vulnerability yet.
Affected and fixed versions
| Product / branch | Fixed in |
|---|---|
| Remote Support 0 to 24.3.1 | Upgrade past 24.3.1; see the advisory |
| Privileged Remote Access 0 to 24.3.1 | Upgrade past 24.3.1; see the advisory |
Always confirm against the vendor advisory, which lists every fixed hotfix.
What it is
A critical vulnerability has been discovered in Privileged Remote Access (PRA) and Remote Support (RS) products which can allow an unauthenticated attacker to inject commands that are run as a site user.
Exploitation
CISA lists this CVE as exploited in the wild since 19 Dec 2024.
Sources
KEV status, EPSS score and vendor data refreshed automatically, last on 13 Oct 2026.