- CISA added two bugs found in BeyondTrust products
- Both were seen in the wild in December 2024
- Federal agencies have until February 3, 2025 to patch up
The US Cybersecurity and Infrastructure Security Agency (CISA) has added two newly discovered BeyondTrust flaws to its catalog of known exploited vulnerabilities (KEV).
The move means CISA has seen evidence that the flaws are being exploited in the wild, and has given federal agencies a deadline to patch the software or stop using it altogether.
In late December 2024, BeyondTrust confirmed it suffered a cyber attack after discovering and disclosing some of its remote support SaaS instances were compromised. Subsequent investigations revealed these two errors, which the company later corrected.
Attack on the Ministry of Finance
The bugs are tracked as CVE-2024-12686 and CVE-2024-12356. The former is a medium vulnerability (6.6 score), described as a flaw in Privileged Remote Access (PRA) and Remote Support (RS) that allows malicious actors with existing administrator privileges to inject commands and run as a website user. The latter is a critical vulnerability that could allow an unauthorized attacker to inject commands run as a website user. It received a 9.8 severity score (critical).
CVE-2024-12356 was added to KEV on December 19, while CVE-2024-12686 on January 13. That means users had until January 9 to fix the first and have until February 3, 2025 to fix the second bug.
The news comes after the US Treasury Department was hit by a cyber attack in early January 2025 in which the attackers, believed to be Silk Typhoon, a notorious cyber espionage group allegedly on the payroll of the Chinese government, used a stolen Remote Support SaaS API key to compromise a BeyondTrust instance.
Silk Typhoon is perhaps best known for targeting around 68,500 servers in early 2021 using Microsoft Exchange Server ProxyLogon zero-days.
Silk Typhoon is part of a wider network of “Typhoon” groups – Volt Typhoon, Salt Typhoon, Flax Typhoon and Brass Typhoon. Salt Typhoon was recently linked to a number of high-profile breaches, including at least four major US telecom operators.
Via Bleeping Computer
