CVE-2025-24916: Tenable Nessus Privilege Escalation Flaw

CVE-2025-24916 Overview

CVE-2025-24916 affects Tenable Network Monitor versions prior to 6.5.1 on Windows hosts. The product fails to enforce secure permissions on sub-directories when installed to a non-default location. Local authenticated users can abuse the weak directory access controls to achieve privilege escalation. The issue is classified under [CWE-284] Improper Access Control.

The vulnerability requires local access and low privileges. Successful exploitation grants attackers elevated rights, breaking the confidentiality, integrity, and availability of the host.

Critical Impact
Local users can escalate privileges to SYSTEM by placing malicious files in insecure installation sub-directories, enabling full compromise of the Windows host running Tenable Network Monitor.

Affected Products

Tenable Nessus Network Monitor versions prior to 6.5.1
Microsoft Windows hosts running Tenable Network Monitor
Non-default installation paths of Tenable Network Monitor on Windows

Discovery Timeline

2025-05-23 - CVE-2025-24916 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24916

Vulnerability Analysis

Tenable Network Monitor installs itself to C:\Program Files\Tenable\NNM by default. Windows applies restrictive access control lists (ACLs) to Program Files, limiting write access to administrators. When operators install the product to a non-default path, the installer does not apply equivalent hardened ACLs to the resulting sub-directories.

The service runs with elevated privileges. Any non-privileged user who can write to the installation sub-directories can plant or replace executables, DLLs, or configuration files consumed by the service. When the service loads those files, the attacker's code executes with SYSTEM privileges.

This is a local attack vector requiring authenticated access. No user interaction is needed once the malicious payload is staged.

Root Cause

The installer for versions prior to 6.5.1 relied on directory inheritance rather than explicitly setting secure ACLs on the installation target. Non-default paths such as D:\Apps\NNM frequently inherit permissive ACLs from parent volumes, granting Users or Authenticated Users write access. The installer did not compensate by hardening the target sub-directories.

Attack Vector

An attacker with a local account on the Windows host enumerates the Tenable Network Monitor installation directory and its ACLs. If a writable sub-directory is discovered, the attacker replaces a service binary or supporting DLL with a malicious payload. On the next service restart or reboot, the payload executes in the security context of the Tenable Network Monitor service account, typically NT AUTHORITY\SYSTEM.

No exploit code is publicly available for this vulnerability. The exploitation mechanism follows well-documented Windows privilege escalation patterns involving weak service directory permissions. Refer to the Tenable Security Advisory TNS-2025-10 for vendor details.

Detection Methods for CVE-2025-24916

Indicators of Compromise

Unexpected modifications to files under the Tenable Network Monitor installation directory outside patch or upgrade windows
New or replaced .exe or .dll files in the NNM installation path with non-Tenable signatures or missing digital signatures
Child processes spawned by the Tenable Network Monitor service executing non-standard binaries such as cmd.exe, powershell.exe, or unsigned utilities
ACL changes to installation sub-directories granting write access to Users, Authenticated Users, or Everyone

Detection Strategies

Audit ACLs on the Tenable Network Monitor installation path using icacls and flag any entry granting write permissions to non-administrative principals
Monitor file creation and modification events (Windows Event ID 4663) on the installation directory
Alert on service binary path modifications for the Tenable Network Monitor service
Correlate service restart events with recent file changes in the installation directory

Monitoring Recommendations

Enable Windows object access auditing for the Tenable Network Monitor installation directory and its sub-directories
Baseline the expected file hashes of Tenable Network Monitor binaries and alert on deviations
Track the parent-child process lineage of the nnm.exe service to detect unexpected child processes
Review scheduled tasks and services referencing paths inside non-default installation locations

How to Mitigate CVE-2025-24916

Immediate Actions Required

Upgrade Tenable Network Monitor to version 6.5.1 or later on all Windows hosts
Audit ACLs on any non-default installation directories and remove write permissions for non-administrative users
Verify the integrity of existing Tenable Network Monitor binaries against vendor-published hashes
Restrict interactive logon rights on hosts running Tenable Network Monitor to reduce local attack surface

Patch Information

Tenable released version 6.5.1 of Nessus Network Monitor to address CVE-2025-24916. The updated installer enforces secure permissions on installation sub-directories regardless of the target path. Download the fixed release and full advisory from the Tenable Security Advisory TNS-2025-10.

Workarounds

Install Tenable Network Monitor to the default location under C:\Program Files\ where Windows applies restrictive ACLs by default
Manually harden the ACLs on non-default installation directories to grant write access only to Administrators and SYSTEM
Remove inherited permissions from the installation directory and explicitly apply a hardened ACL template

bash

# Configuration example: harden ACLs on a non-default NNM install path
icacls "D:\Apps\NNM" /inheritance:r
icacls "D:\Apps\NNM" /grant:r "Administrators:(OI)(CI)F"
icacls "D:\Apps\NNM" /grant:r "SYSTEM:(OI)(CI)F"
icacls "D:\Apps\NNM" /grant:r "Users:(OI)(CI)RX"