BeyondTrust Remote Support Unauthenticated RCE (CVE-2024-12356)

CVE-2024-12356 is an unauthenticated remote code execution flaw in BeyondTrust Remote Support (formerly Bomgar). Attackers exploit the web interface on Linux or Windows appliances to run commands as the service account.

Affected versions

• BeyondTrust Remote Support before 24.3.1
• Appliances with port 443 open to helpdesk users or the internet

Detect exposure

nmap -p 443 --script http-title support.example.com
curl -sk https://support.example.com/ | grep -i beyondtrust

Patching Method

1. Download fixed appliance build 24.3.1+ from BeyondTrust portal.
2. Notify helpdesk — brief outage during upgrade.
3. Apply update via appliance admin Maintenance → Upgrade (Linux appliance: upload vendor tarball or run built-in updater).
4. Reboot if prompted; verify version in admin dashboard.
5. Invalidate all active support sessions and regenerate appliance API keys.

# Linux appliance post-patch audit
grep -i 'Remote Support' /opt/beyondtrust/version 2>/dev/null
find /opt -mtime -3 -type f -name '*.sh' 2>/dev/null

Until patched

• Restrict support portal to corporate IP/VPN only
• Disable internet-facing Remote Support if not business-critical
• CISA KEV listed — assume active exploitation