Command injection in BeyondTrust Privileged Remote Access
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-77.
Summary
BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) versions 23.2.1 and 23.2.2 contain a command injection vulnerability which can be exploited through a malicious HTTP request. Successful exploitation of this vulnerability can allow an unauthenticated remote attacker to execute underlying operating system commands within the context of the site user. This issue is fixed in version 23.2.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| BeyondTrust | Privileged Remote Access (PRA) | 23.2.1; 23.2.2 | — | No fix listed | CNA |
| BeyondTrust | Remote Support (RS) | 23.2.1; 23.2.2 | — | No fix listed | CNA |
- Privileged Remote Access (PRA) VendorBeyondTrust Affected 23.2.1; 23.2.2 Fixed in — No fix listed CNA
- Remote Support (RS) VendorBeyondTrust Affected 23.2.1; 23.2.2 Fixed in — No fix listed CNA
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:beyondtrust:privileged_remote_access:23.2.1:*:*:*:*:*:*:* | 23.2.1 | Vulnerable | BeyondTrust |
| cpe:2.3:a:beyondtrust:privileged_remote_access:23.2.2:*:*:*:*:*:*:* | 23.2.2 | Vulnerable | BeyondTrust |
| cpe:2.3:a:beyondtrust:remote_support:23.2.1:*:*:*:*:*:*:* | 23.2.1 | Vulnerable | BeyondTrust |
| cpe:2.3:a:beyondtrust:remote_support:23.2.2:*:*:*:*:*:*:* | 23.2.2 | Vulnerable | BeyondTrust |
- cpe:2.3:a:beyondtrust:privileged_remote_access:23.2.1:*:*:*:*:*:*:* Versions 23.2.1 Vulnerable ·BeyondTrust
- cpe:2.3:a:beyondtrust:privileged_remote_access:23.2.2:*:*:*:*:*:*:* Versions 23.2.2 Vulnerable ·BeyondTrust
- cpe:2.3:a:beyondtrust:remote_support:23.2.1:*:*:*:*:*:*:* Versions 23.2.1 Vulnerable ·BeyondTrust
- cpe:2.3:a:beyondtrust:remote_support:23.2.2:*:*:*:*:*:*:* Versions 23.2.2 Vulnerable ·BeyondTrust
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2023-4310
- 2026-10-03 Alias added: GHSA-7q7j-jq8x-xcjh
References
More BeyondTrust Privileged Remote Access vulnerabilities
- TI-2026-01414 Remote code execution vulnerability in BeyondTrust Remote Support (RS) and Privileged Remote Access (PRA) KEVCVSS 4.0CRITICAL 9.9
- TI-2024-11463 Command Injection Vulnerability in Remote Support(RS) & Privileged Remote Access (PRA) KEVCVSS 3.1CRITICAL 9.8
- TI-2024-11765 Command Injection vulnerability in Remote Support(RS) & Privilege Remote Access (PRA) KEVCVSS 3.1HIGH 7.2
- TI-2023-09461 BeyondTrust Privileged Remote Access (PRA) versions 22.2.x to 22.4.x are vulnerable to a… CVSS 3.1HIGH 7.8
- TI-2026-28959 High-Severity Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access CVSS 4.0HIGH 8.7
- TI-2026-28958 Critical Pre-Authentication Vulnerability in BeyondTrust Remote Support and Privileged Remote Access CVSS 4.0CRITICAL 9.2
Sources
- CVE-2023-4310 · CVE Program
- CVE-2023-4310 · NVD
- FIRST EPSS
- GHSA-7q7j-jq8x-xcjh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences