{"id":6930,"date":"2025-01-15T10:51:35","date_gmt":"2025-01-15T16:51:35","guid":{"rendered":"https:\/\/www.darkreading.com\/vulnerabilities-threats\/cisa-warns-of-second-vuln-found-in-beyondtrust-breach-investigation"},"modified":"2025-01-15T10:51:35","modified_gmt":"2025-01-15T16:51:35","slug":"cisa-second-beyondtrust-vulnerability-added-to-kev-catalog","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2025\/01\/15\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog\/","title":{"rendered":"CISA: Second BeyondTrust Vulnerability Added to KEV Catalog"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

NEWS BRIEF<\/span><\/span><\/p>\n

The Cybersecurity and Infrastructure Security Agency (CISA) is urging federal agencies to patch a command injection flaw tracked as <\/span>CVE-2024-12686<\/a><\/span>, otherwise known as BT24-11, and has added it to the Known Exploited Vulnerabilities (KEV) Catalog.<\/span><\/p>\n

The medium-severity security bug was found as a part of BeyondTrust’s Remote Support SaaS Service security investigation, which was launched after a major data breach at the US <\/span>Treasury Department<\/a><\/span>. <\/span>Silk Typhoon<\/a><\/span>, a Chinese hacking group, was reportedly responsible for the December 2024 cyberattack, in which threat actors were able to gain credentials to Treasury workstations through the third-party vendor and then steal data. On Dec. 18, BeyondTrust reported identifying BT24-11 within its self-hosted and cloud Remote Support and Privileged Remote Access products, after reporting BT24-10 just two days prior.<\/span><\/p>\n

On Jan. 6, in its latest update, BeyondTrust reported that its forensic investigation is nearly complete and that all software-as-a-service instances of BeyondTrust Remote Support have been fully patched with no new identified victims.<\/span><\/p>\n

“All cloud instances have been patched for this vulnerability,” BeyondTrust stated in the <\/span>update<\/a><\/span>. “We have also released a patch for self-hosted versions.”<\/span><\/p>\n

CISA stated that the vulnerability “can be exploited by an attacker with existing administrative privileges to inject commands and run as a site user.” That would allow a remote attacker to execute underlying operating system commands.<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

NEWS BRIEF The Cybersecurity and Infrastructure Security Agency (CISA) is<\/p>\n","protected":false},"author":12,"featured_media":6931,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-6930","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog.png?fit=1920%2C1080&ssl=1",1920,1080,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog.png?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog.png?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog.png?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog.png?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog.png?fit=1536%2C864&ssl=1",1536,864,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog.png?fit=1920%2C1080&ssl=1",1920,1080,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog.png?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog.png?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog.png?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2025\/01\/cisa-second-beyondtrust-vulnerability-added-to-kev-catalog.png?fit=1920%2C1080&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6930","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=6930"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6930\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/6931"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=6930"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=6930"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=6930"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}