CVE-2025-36625: Nessus Authentication Bypass Vulnerability

CVE-2025-36625 Overview

CVE-2025-36625 is a log injection vulnerability affecting Nessus versions prior to 10.8.4. An unauthenticated attacker can manipulate HTTP requests to alter Nessus logging entries. The flaw is categorized under [CWE-117] Improper Output Neutralization for Logs.

The vulnerability allows adversaries to inject forged content into Nessus log files by crafting malicious HTTP requests. This can undermine forensic investigations, obscure attacker activity, and mislead incident responders relying on log data for detection and response.

Critical Impact
Unauthenticated attackers can forge or corrupt Nessus log entries via HTTP request manipulation, compromising the integrity of audit trails used for security monitoring and incident response.

Affected Products

Tenable Nessus versions prior to 10.8.4
Nessus Professional deployments running affected builds
Nessus Expert deployments running affected builds

Discovery Timeline

2025-04-18 - CVE-2025-36625 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-36625

Vulnerability Analysis

The vulnerability resides in how Nessus processes and records HTTP request data into its application logs. Nessus fails to properly neutralize or sanitize attacker-controlled input before writing it to log files. This weakness maps to [CWE-117] Improper Output Neutralization for Logs.

An unauthenticated remote attacker can send crafted HTTP requests to the Nessus web interface. The malicious payload is written verbatim into logging entries. Attackers can inject newline characters, control sequences, or forged log lines to fabricate events or hide malicious actions.

The integrity impact is limited to log data, and the vulnerability does not directly allow code execution, data theft, or service disruption. However, tampered logs can significantly complicate detection efforts and post-incident analysis in enterprise environments.

Root Cause

The root cause is missing input sanitization in the logging routines that record HTTP request metadata. User-controlled fields such as headers, URIs, or parameters are written to log files without stripping or encoding line terminators and control characters.

Attack Vector

Exploitation requires network access to the Nessus HTTP interface and user interaction with logged data during review. The attacker crafts an HTTP request containing embedded newline sequences or fabricated log content. When Nessus records the request, the injected data appears as legitimate log entries. See the Tenable Security Advisory for technical specifics.

The vulnerability manifests when logging routines concatenate raw HTTP request data into log output streams without neutralizing CR/LF characters or escape sequences. No verified public exploit code is available at this time.

Detection Methods for CVE-2025-36625

Indicators of Compromise

Nessus log entries containing unexpected line breaks, control characters, or duplicated timestamp patterns
HTTP requests to the Nessus web interface with encoded CR/LF sequences (%0d%0a) in headers or URI parameters
Log entries referencing authentication events or scan actions that do not correlate with actual Nessus activity

Detection Strategies

Compare Nessus application logs against network-level packet captures to identify discrepancies between recorded and actual HTTP traffic
Deploy log-parsing rules that flag unusual control characters or newline sequences within Nessus log fields
Monitor for unauthenticated HTTP requests carrying suspicious encoded payloads targeting the Nessus management interface

Monitoring Recommendations

Forward Nessus logs to a centralized SIEM with integrity verification and tamper-evident storage
Establish baseline patterns for normal Nessus log formatting and alert on deviations
Restrict network access to the Nessus web interface to trusted administrative networks only

How to Mitigate CVE-2025-36625

Immediate Actions Required

Upgrade all Nessus installations to version 10.8.4 or later as specified in the Tenable advisory
Audit existing Nessus logs for anomalies that may indicate prior exploitation attempts
Restrict network exposure of the Nessus management interface to trusted administrative subnets

Patch Information

Tenable has released Nessus version 10.8.4 which remediates the log injection vulnerability. Administrators should download the patched build from the Tenable downloads portal and apply it following standard change management procedures. Full patch details are available in the Tenable Security Advisory TNS-2025-05.

Workarounds

Place the Nessus web interface behind a reverse proxy or web application firewall that strips CR/LF characters from HTTP request fields
Limit inbound access to the Nessus HTTPS port using host-based firewall rules or network segmentation
Enable strict log integrity monitoring on the Nessus host to detect unauthorized modifications

bash

# Example iptables rule restricting Nessus web interface access
iptables -A INPUT -p tcp --dport 8834 -s 10.0.0.0/8 -j ACCEPT
iptables -A INPUT -p tcp --dport 8834 -j DROP