by Kastro
Paper/Archive/CVE-2025-5309

CVE-2025-5309

BeyondTrust Remote support & Privileged Remote Access — Remote Support & Privileged Remote Access server side template injection

EPSS 0.9%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.2.612 × 2012.2No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The chat feature within Remote Support (RS) and Privileged Remote Access (PRA) is vulnerable to a Server-Side Template Injection vulnerability which can lead to remote code execution.

Affected

ProductAffectedFixed inSource
Remote support & Privileged Remote Access24.2.2 – 24.2.4–CNA
Remote support & Privileged Remote Access24.3.1 – 24.3.3–CNA
Remote support & Privileged Remote Access25.1.1–CNA
Remote Support(RS) & Privileged Remote Access(PRA)24.2.2 – 24.2.4–CNA
Remote Support(RS) & Privileged Remote Access(PRA)24.3.1 – 24.3.4–CNA
Remote Support(RS) & Privileged Remote Access(PRA)25.1.1–CNA

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
BT (CNA)8.6CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refbeyondtrust.com/trust-center/security-advisories/bt25-04