{"uuid": "7e759ce2-4cea-4336-b335-421b9faddc56", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2025-1094", "type": "seen", "source": "https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb", "content": "{\"aliases\": [], \"arch\": \"cmd\", \"author\": [\"sfewer-r7\"], \"autofilter_ports\": [80, 8080, 443, 8000, 8888, 8880, 8008, 3000, 8443], \"autofilter_services\": [\"http\", \"https\"], \"check\": true, \"default_credential\": false, \"description\": \"This exploit achieves unauthenticated remote code execution against BeyondTrust Privileged Remote\\n          Access (PRA) and Remote Support (RS), with the privileges of the site user of the targeted BeyondTrust\\n          product site. This exploit targets PRA and RS versions 24.3.1 and below.\", \"disclosure_date\": \"2024-12-16\", \"fullname\": \"exploit/linux/http/beyondtrust_pra_rs_unauth_rce\", \"is_install_path\": true, \"mod_time\": \"2026-04-22 11:54:55 +0000\", \"name\": \"BeyondTrust Privileged Remote Access (PRA) and Remote Support (RS) unauthenticated Remote Code Execution\", \"needs_cleanup\": null, \"notes\": {\"Reliability\": [\"repeatable-session\"], \"SideEffects\": [\"ioc-in-logs\"], \"Stability\": [\"crash-safe\"]}, \"path\": \"/modules/exploits/linux/http/beyondtrust_pra_rs_unauth_rce.rb\", \"platform\": \"Linux,Unix\", \"post_auth\": false, \"rank\": 600, \"ref_name\": \"linux/http/beyondtrust_pra_rs_unauth_rce\", \"references\": [\"CVE-2024-12356\", \"CVE-2025-1094\", \"URL-http://web.archive.org/web/20241226144006/https://www.beyondtrust.com/trust-center/security-advisories/bt24-10\", \"URL-https://www.postgresql.org/support/security/CVE-2025-1094/\", \"URL-https://attackerkb.com/topics/G5s8ZWAbYH/cve-2024-12356/rapid7-analysis\"], \"rport\": 443, \"session_types\": false, \"targets\": [\"Default\"], \"type\": \"exploit\"}", "creation_timestamp": "2026-09-08T06:48:24.806917Z"}