CVE-2025-24914: Nessus Privilege Escalation Vulnerability

CVE-2025-24914 Overview

CVE-2025-24914 is a local privilege escalation vulnerability affecting Tenable Nessus on Windows hosts. When administrators install Nessus to a non-default location, versions prior to 10.8.4 fail to enforce secure permissions on sub-directories under the install path. A local user who can write to those sub-directories can plant executables or libraries that later run with elevated privileges. The weakness maps to Incorrect Default Permissions [CWE-276]. Tenable addressed the issue in Nessus 10.8.4 and documented it in Tenable Security Advisory TNS-2025-05.

Critical Impact
A low-privileged local user on a Windows host running a non-default Nessus install can escalate to SYSTEM by planting malicious files in improperly secured sub-directories.

Affected Products

Tenable Nessus on Windows, versions prior to 10.8.4
Non-default installation paths on Windows hosts
Fixed in Nessus 10.8.4

Discovery Timeline

2025-04-18 - CVE-2025-24914 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24914

Vulnerability Analysis

The vulnerability resides in the Nessus Windows installer's handling of non-default installation paths. When an administrator selects a custom install directory, the installer creates Nessus sub-directories but does not apply restrictive Access Control Lists (ACLs) to them. On Windows, directories that inherit permissions from a parent such as C:\ can grant write access to non-privileged users through the BUILTIN\Users or Authenticated Users groups.

Nessus runs its scanner service under the LocalSystem account. If a local attacker can write files into these sub-directories, they can stage a DLL search-order hijack or replace a binary that the service loads at startup. The next service restart executes the attacker-controlled code with SYSTEM privileges, resulting in full local compromise.

Exploitation requires local access and low privileges, but no user interaction. The scope is unchanged and the impact covers confidentiality, integrity, and availability.

Root Cause

The root cause is Incorrect Default Permissions [CWE-276]. The installer relies on inherited ACLs for custom paths rather than explicitly setting a hardened Discretionary Access Control List (DACL) that restricts write access to administrators and SYSTEM. Default paths under C:\Program Files\Tenable\Nessus inherit secure ACLs from Program Files, which is why the issue only manifests in non-default locations.

Attack Vector

An attacker with an unprivileged local account enumerates sub-directories inside the Nessus install path and identifies any folder that grants write access to standard users. The attacker drops a malicious binary or DLL using a name the Nessus service loads. When the service restarts, whether through reboot, update, or scheduled task, the injected code executes as SYSTEM. No network access or user interaction is required.

No verified public proof-of-concept exists at this time. See Tenable Security Advisory TNS-2025-05 for vendor details.

Detection Methods for CVE-2025-24914

Indicators of Compromise

Unexpected executables, DLLs, or scripts created in Nessus sub-directories by non-administrative users
Nessus service (Tenable Nessus) spawning child processes outside its normal binary set
Modifications to files under the Nessus install path with owners other than SYSTEM or Administrators
Nessus service restarts followed by SYSTEM-level process creation of unfamiliar binaries

Detection Strategies

Audit ACLs on the Nessus install directory and all sub-directories using icacls and flag any entries granting write access to Users, Authenticated Users, or Everyone
Enable Windows file system auditing on the Nessus install path to log write and create events by non-privileged principals
Correlate service start events (Event ID 7036) for Tenable Nessus with subsequent process creation events (4688) under nessusd.exe or its children

Monitoring Recommendations

Track integrity of binaries and libraries within the Nessus install path using file integrity monitoring
Alert on DLL loads by nessusd.exe from paths outside the expected install directory or Windows system folders
Inventory all Windows hosts running Nessus and record whether the install path is default or custom, then prioritize custom installations for review

How to Mitigate CVE-2025-24914

Immediate Actions Required

Upgrade Nessus on all Windows hosts to version 10.8.4 or later
Identify Windows hosts where Nessus was installed to a non-default location and audit the ACLs on each sub-directory
Remove write permissions for Users and Authenticated Users from the Nessus install tree, leaving only SYSTEM and Administrators
Restart the Nessus service after correcting permissions to ensure no staged files remain resident

Patch Information

Tenable released Nessus 10.8.4 to remediate CVE-2025-24914. The updated installer enforces secure permissions on sub-directories regardless of the chosen installation path. Download the fixed release and review guidance in Tenable Security Advisory TNS-2025-05.

Workarounds

Reinstall Nessus to the default C:\Program Files\Tenable\Nessus path, which inherits hardened ACLs from Program Files
If reinstallation is not feasible, manually harden the existing install path by removing inherited permissions and applying explicit ACLs restricted to SYSTEM and the local Administrators group
Restrict interactive and remote logon rights on Nessus scanner hosts to reduce the local attacker population

bash

# Audit and harden Nessus install directory ACLs on Windows
icacls "D:\Nessus" /T

# Remove inherited permissions and grant only SYSTEM and Administrators
icacls "D:\Nessus" /inheritance:r
icacls "D:\Nessus" /grant:r "SYSTEM:(OI)(CI)F" "BUILTIN\Administrators:(OI)(CI)F"
icacls "D:\Nessus" /remove "BUILTIN\Users" "Authenticated Users" "Everyone"