CVE-2025-24917: Nessus Network Monitor Privilege Escalation

CVE-2025-24917 Overview

CVE-2025-24917 is a local privilege escalation vulnerability affecting Tenable Network Monitor versions prior to 6.5.1 on Windows hosts. A non-administrative user can stage files in a local directory that the service loads while running with SYSTEM privileges. Successful exploitation allows arbitrary code execution in the highest-privileged local context. The flaw is classified under [CWE-284] (Improper Access Control) and requires local, low-privileged access without user interaction. Tenable published advisory TNS-2025-10 and remediated the issue in version 6.5.1.

Critical Impact
A low-privileged local user can execute arbitrary code as SYSTEM, achieving full compromise of the affected Windows host.

Affected Products

Tenable Network Monitor versions prior to 6.5.1
Microsoft Windows (host operating system)
Deployments where non-administrative users have write access to relevant local directories

Discovery Timeline

2025-05-23 - CVE-2025-24917 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-24917

Vulnerability Analysis

Tenable Network Monitor runs as a Windows service under the SYSTEM account. The vulnerability stems from improper access control on a local directory that the service reads during operation. A non-administrative user can place attacker-controlled files in that directory. The service then loads or executes those files with SYSTEM privileges, resulting in local privilege escalation. This pattern is consistent with insecure file or directory permissions permitting an unprivileged account to influence a privileged process.

Root Cause

The root cause is improper access control [CWE-284] on a filesystem location used by the SYSTEM-level service. Directory permissions allow non-administrative users to write files that the privileged process later trusts. No signature validation, path restriction, or ACL enforcement prevents the low-privileged user from staging attacker-controlled content in the load path.

Attack Vector

Exploitation requires an authenticated, low-privileged local account on a Windows host running a vulnerable version of Tenable Network Monitor. The attacker writes crafted files to the local directory consumed by the service. When the service subsequently reads or executes the staged content, the attacker's code runs as SYSTEM. No network access, administrative rights, or user interaction is required. See the Tenable Security Advisory TNS-2025-10 for vendor-confirmed details.

Detection Methods for CVE-2025-24917

Indicators of Compromise

Unexpected files (executables, DLLs, scripts, or configuration files) written to Tenable Network Monitor installation or working directories by non-administrative users
Child processes spawned by the Tenable Network Monitor service running under the NT AUTHORITY\SYSTEM account that do not match legitimate product binaries
New or modified persistence artifacts (services, scheduled tasks, registry autoruns) created shortly after file writes to the monitored directory

Detection Strategies

Audit file creation and modification events in Tenable Network Monitor directories, correlating the writing user's SID against expected administrative accounts
Alert on process ancestry where the Network Monitor service launches unsigned or unexpected binaries
Baseline the installation directory contents and flag deviations from the vendor-shipped file set

Monitoring Recommendations

Enable Windows Security event ID 4663 (object access) on Tenable Network Monitor directories to capture write events by non-administrative users
Ingest Sysmon Event ID 1 (process creation) and Event ID 11 (file create) into a SIEM for correlation against SYSTEM-context activity
Track version inventory across endpoints to confirm all Tenable Network Monitor instances are upgraded to 6.5.1 or later

How to Mitigate CVE-2025-24917

Immediate Actions Required

Upgrade Tenable Network Monitor to version 6.5.1 or later on all Windows hosts, following Tenable advisory TNS-2025-10
Inventory all Windows systems running Tenable Network Monitor and prioritize hosts with interactive non-administrative users
Review directory ACLs on the Tenable Network Monitor installation path to ensure only administrators have write access

Patch Information

Tenable released the fix in Tenable Network Monitor version 6.5.1. The vendor advisory TNS-2025-10 documents affected versions, the fixed release, and download locations. Apply the patched version to eliminate the underlying access control weakness.

Workarounds

Restrict interactive and remote login to affected Windows hosts to administrative users until the patch is applied
Tighten NTFS permissions on Tenable Network Monitor directories to deny write access to non-administrative principals
Monitor the service account's process tree for unexpected child processes and quarantine hosts showing anomalous SYSTEM-context execution

bash

# Verify installed Tenable Network Monitor version on Windows (PowerShell)
Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\*" |
  Where-Object { $_.DisplayName -like "*Network Monitor*" } |
  Select-Object DisplayName, DisplayVersion, Publisher

# Inspect ACLs on the installation directory
Get-Acl "C:\Program Files\Tenable\Nessus Network Monitor" | Format-List