CVE-2025-24915: Nessus Agent Privilege Escalation Flaw

CVE-2025-24915 Overview

CVE-2025-24915 is a local privilege escalation vulnerability affecting Tenable Nessus Agent installations on Windows hosts. When administrators install the agent to a non-default location, versions prior to 10.8.3 fail to enforce secure permissions on sub-directories. Local users with write access to those directories can leverage this weakness to escalate privileges to SYSTEM. The flaw is classified under CWE-276: Incorrect Default Permissions. Tenable addressed the issue in Nessus Agent 10.8.3 and documented the fix in Tenable Security Advisory TNS-2025-02.

Critical Impact
A low-privileged local user can achieve full SYSTEM-level code execution on Windows hosts running Nessus Agent installed to a non-default directory.

Affected Products

Tenable Nessus Agent for Windows versions prior to 10.8.3
Windows hosts where the agent was installed to a non-default installation path
Deployments where the parent directory permissions were not hardened by the administrator

Discovery Timeline

2025-03-21 - CVE-2025-24915 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24915

Vulnerability Analysis

The Nessus Agent installer creates its runtime directory tree during setup. When the target path is the default location under C:\Program Files\, Windows inherits restrictive access control lists (ACLs) that prevent non-administrative users from modifying files. When an administrator selects a non-default installation path, the installer does not explicitly apply hardened ACLs to the created sub-directories. The sub-directories instead inherit permissions from the parent path, which may grant write access to standard users.

The Nessus Agent service runs as NT AUTHORITY\SYSTEM. An attacker who can write to a directory containing service executables or dynamic-link libraries (DLLs) can replace or plant files that the service later loads. Execution of the tampered content occurs in the SYSTEM security context, granting full control of the host.

Root Cause

The root cause is incorrect default permissions [CWE-276] applied during installation. The installer relies on parent-directory inheritance rather than explicitly setting ACLs on the agent's sub-directories. Any weakness in the parent path's permissions propagates to files that the SYSTEM-level service trusts.

Attack Vector

Exploitation requires local access and low privileges on the target host. The attacker identifies a Nessus Agent installation in a non-default path with permissive ACLs. The attacker writes a malicious executable or DLL into a location the agent service loads at startup or during operation. When the service loads the planted file, the code runs as SYSTEM. Refer to Tenable Security Advisory TNS-2025-02 for vendor-supplied technical detail.

Detection Methods for CVE-2025-24915

Indicators of Compromise

Unexpected executable or DLL files appearing under the Nessus Agent installation directory
Modifications to files owned by the Nessus Agent service performed by non-administrative user accounts
Nessus Agent service (Tenable Nessus Agent) loading modules from unusual paths or with unexpected file hashes

Detection Strategies

Audit the ACLs of the Nessus Agent installation directory using icacls and flag any entries granting write access to Users, Authenticated Users, or Everyone
Monitor file-creation and file-modification events (Windows Event ID 4663) targeting the Nessus Agent directory tree
Correlate process-creation events where a child of the Nessus Agent service executes an unsigned or newly written binary

Monitoring Recommendations

Enable Windows object-access auditing on all Nessus Agent installation paths across the fleet
Inventory hosts to identify Nessus Agent installations outside the default C:\Program Files\Tenable\Nessus Agent\ path
Track version telemetry to confirm all agents are running 10.8.3 or later

How to Mitigate CVE-2025-24915

Immediate Actions Required

Upgrade all Tenable Nessus Agent for Windows deployments to version 10.8.3 or later
Audit non-default installation paths and remove write permissions for non-administrative principals
Restart the Nessus Agent service after applying corrected ACLs to ensure the service reloads trusted files

Patch Information

Tenable released Nessus Agent 10.8.3 to enforce secure permissions on sub-directories regardless of the installation path. The advisory and download links are available at Tenable Security Advisory TNS-2025-02. Administrators should validate patch deployment through their software inventory tooling.

Workarounds

Reinstall Nessus Agent to the default C:\Program Files\Tenable\Nessus Agent\ location, which inherits secure ACLs
Manually apply restrictive ACLs to the non-default installation directory, granting write access only to SYSTEM and Administrators
Restrict interactive logon on hosts running Nessus Agent to reduce local attacker opportunity until patching is complete

bash

# Configuration example - harden ACLs on a non-default Nessus Agent path
icacls "D:\Tools\NessusAgent" /inheritance:r
icacls "D:\Tools\NessusAgent" /grant:r "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F"
icacls "D:\Tools\NessusAgent" /remove "Users" "Authenticated Users" "Everyone"