CVE-2014-2848 in Nessus
Summary
by MITRE
A race condition in the wmi_malware_scan.nbin plugin before 201402262215 for Nessus 5.2.1 allows local users to gain privileges by replacing the dissolvable agent executable in the Windows temp directory with a Trojan horse program.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 05/10/2026
The vulnerability described in CVE-2014-2848 represents a critical race condition flaw within the wmi_malware_scan.nbin plugin component of Nessus vulnerability scanning software. This issue affects Nessus versions prior to 201402262215 and specifically targets Windows operating systems where the plugin executes with elevated privileges. The vulnerability stems from improper handling of temporary files during malware scanning operations, creating a window of opportunity for privilege escalation attacks. The flaw is classified under CWE-367 which identifies Time-of-Check to Time-of-Use (TOCTOU) vulnerabilities, where the system's state changes between the time a security check is performed and when the resource is accessed.
The technical implementation of this vulnerability exploits the temporal gap between when the plugin checks for the existence of a dissolvable agent executable in the Windows temporary directory and when it actually executes that program. During this brief window, a local attacker can replace the legitimate executable with a malicious Trojan horse program that mimics the expected functionality. When the plugin subsequently executes the replaced file, it inadvertently runs the attacker's malicious code with the elevated privileges of the Nessus scanning process. This race condition occurs because the plugin does not properly validate the integrity of the temporary executable or implement appropriate file locking mechanisms during the execution phase.
The operational impact of this vulnerability is significant as it allows local attackers to achieve privilege escalation from standard user level to system level privileges. This represents a serious security risk in enterprise environments where Nessus is commonly deployed for network vulnerability scanning, as it can be exploited by attackers who have gained access to a low-privilege account. The attack vector is particularly concerning because it requires minimal initial access and leverages the legitimate administrative functionality of Nessus to execute malicious code. From an adversary perspective, this vulnerability aligns with ATT&CK technique T1068 which covers 'Local Privilege Escalation' and specifically demonstrates how process injection and race condition exploitation can be combined to achieve system compromise.
Mitigation strategies for this vulnerability primarily focus on updating to the patched version of Nessus released after February 26, 2014, which addresses the race condition by implementing proper file validation and atomic operations during the execution of temporary files. Organizations should also consider implementing additional security controls such as restricting write permissions to the Windows temporary directory for the Nessus service account, monitoring for unauthorized file modifications in system directories, and conducting regular security assessments of third-party plugins. The vulnerability highlights the importance of proper temporal consistency in security-critical applications and demonstrates how seemingly minor implementation flaws can create significant escalation opportunities. Security teams should also review other Nessus plugins for similar race condition vulnerabilities and implement least privilege principles for service accounts running scanning operations.