BeyondTrust Releases Urgent Patch for Critical Security Flaw

December 18, 2024December 18, 2024

Critical Security Flaw Discovered in BeyondTrust’s Privileged Remote Access and Remote Support Products

BeyondTrust has recently unveiled alarming details about a critical security vulnerability affecting its Privileged Remote Access (PRA) and Remote Support (RS) products. This vulnerability, tracked as CVE-2024-12356, has a high CVSS score of 9.8 and poses significant risks, as it could allow unauthorized users to execute arbitrary commands on affected systems.

Understanding the Vulnerability in Privileged Remote Access

Privileged Remote Access (PRA) is designed to control, manage, and audit privileged accounts, providing zero trust access to both on-premises and cloud resources. Meanwhile, Remote Support enables service desk personnel to establish secure connections to remote systems and mobile devices. Unfortunately, the recent discovery indicates that an unauthenticated attacker could exploit this vulnerability through command injection, potentially compromising sensitive systems.

Impact of CVE-2024-12356 on Users

The vulnerability affects the following versions:

Privileged Remote Access: Versions 24.3.1 and earlier. Fixed in PRA patches BT24-10-ONPREM1 or BT24-10-ONPREM2.
Remote Support: Versions 24.3.1 and earlier. Fixed in RS patches BT24-10-ONPREM1 or BT24-10-ONPREM2.

To safeguard against potential threats, BeyondTrust has already implemented a patch for cloud instances as of December 16, 2024. Users of on-premises versions are strongly advised to apply the latest updates, especially if they are not enrolled in automatic updates. BeyondTrust noted, "If customers are on a version older than 22.1, they will need to upgrade in order to apply this patch."

Background of the Discovery

This critical vulnerability was identified during an ongoing forensic investigation initiated after a security incident on December 2, 2024, which involved a limited number of Remote Support SaaS customers. BeyondTrust reported that a compromised API key was at the heart of this incident. The company promptly revoked the key, notified affected customers, and suspended impacted instances while providing alternative solutions.

Next Steps for Affected Users

To protect systems and data, BeyondTrust recommends the following actions:

Update Software: Ensure that you are using the latest versions of PRA and RS.
Apply Patches: Install the necessary patches if you are using affected versions.
Monitor Communications: Stay updated on security advisories from BeyondTrust regarding this vulnerability.

For further details, users can reference BeyondTrust’s official advisory here. Additionally, for more information on cybersecurity best practices, you can read about command injection vulnerabilities.

Stay Informed and Secure

The discovery of this critical vulnerability underscores the importance of maintaining updated software and security protocols. We encourage readers to share their thoughts in the comments below and stay tuned for more updates on cybersecurity news. Follow us on Twitter and LinkedIn for exclusive content and insights into the latest in cybersecurity.

Critical RCE Vulnerability in GFI KerioControl Exposed

January 9, 2025January 9, 2025

A critical security vulnerability, CVE-2024-52875, has been identified in GFI KerioControl firewalls, allowing remote code execution (RCE) through CRLF injection attacks. This flaw affects versions 9.2.5 to 9.4.5 and enables unauthorized manipulation of HTTP response headers, leading to possible XSS attacks. GFI released a patch (9.4.5 Patch 1) on December 19, 2024, but proof-of-concept exploits are already circulating. Exploitation attempts have been observed since December 28, 2024, with thousands of vulnerable instances reported globally. Users are advised to update their systems, monitor traffic, and educate network administrators on the risks.

Cisco Alerts: Decade-Old ASA WebVPN Flaw Under Attack

December 3, 2024December 12, 2024

Cisco has issued a critical alert about the active exploitation of a decade-old vulnerability, CVE-2014-2120, in its Adaptive Security Appliance (ASA). This flaw allows unauthenticated attackers to execute cross-site scripting (XSS) attacks via the WebVPN login page. The urgency is heightened by reports from CloudSEK regarding the use of this vulnerability in distributing AndroxGh0st malware, linked to the Mozi botnet. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to remediate it by December 3, 2024. Users are advised to update installations, monitor for suspicious activity, and educate employees on security risks.

Fortinet Urges Updates to Fix Critical FortiWLM Vulnerability

December 19, 2024December 19, 2024

Fortinet has issued a critical advisory for a security vulnerability in its Wireless LAN Manager (FortiWLM), identified as CVE-2023-34990, which has a CVSS score of 9.6. This flaw allows remote attackers to exploit a path traversal issue, risking unauthorized access to sensitive files. It affects versions 8.6.0 to 8.6.5 and 8.5.0 to 8.5.4, and has been patched in newer releases. Additionally, a related vulnerability, CVE-2024-48889, impacts FortiManager, allowing unauthorized code execution. Users are urged to update their systems promptly to protect against these critical vulnerabilities.

New iOS and macOS Flaw Allowed TCC Bypass, Now Patched

December 12, 2024December 12, 2024

Apple has addressed a critical security vulnerability in iOS and macOS, tracked as CVE-2024-44131, which allowed unauthorized access to sensitive data by bypassing the Transparency, Consent, and Control (TCC) framework. This flaw was discovered by Jamf Threat Labs and could enable rogue applications to access files, Health data, and other sensitive information without user alerts. Apple’s latest updates for iOS 18, iPadOS 18, and macOS Sequoia 15 patch this issue, alongside fixes for several other vulnerabilities. Users are urged to update their devices to enhance security and protect against potential risks.

Microsoft Tackles 159 Vulnerabilities in Major Patch Tuesday

January 15, 2025January 15, 2025

In October 2023, eight zero-day vulnerabilities were discovered in Windows Hyper-V, with three confirmed to be exploited in real-world attacks. Key vulnerabilities include three elevation of privilege (EoP) flaws in the Hyper-V NT Kernel and several remote code execution (RCE) issues in Microsoft Access. Cybersecurity experts stress the urgency of patching these vulnerabilities to prevent attackers from gaining SYSTEM-level privileges, which could lead to severe consequences like disabling security tools and credential theft. Organizations are urged to adopt proactive cybersecurity measures to mitigate these risks and ensure robust system protection.

Argentinian Airport Security Payroll System Breached

January 7, 2025January 7, 2025

Argentina’s Airport Security Police (PSA) experienced a significant cyberattack that compromised personal and financial information of its officers and civilian employees, targeting vulnerabilities in Banco Nacion’s payroll system. Attackers accessed confidential payroll records, enabling unauthorized salary deductions. In response, the PSA has temporarily suspended certain services. This incident follows a recent trend of cyberattacks in Argentina’s public sector, including breaches affecting millions through government applications and major institutions like Telecom Argentina and the Central Bank. The situation underscores escalating cybersecurity challenges and the necessity for robust protective measures in governmental organizations.