CVE-2025-24915 in Nessus Agent
Summary
by MITRE • 03/21/2025
When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 03/21/2025
The vulnerability described in CVE-2025-24915 affects Nessus Agent installations on Windows systems where the software is deployed to non-standard directory locations. This issue represents a classic permission misconfiguration problem that can lead to significant security implications for affected systems. The vulnerability specifically impacts versions of Nessus Agent prior to 10.8.3, indicating that this was a known issue that required remediation through software updates. The flaw occurs during the installation process when the agent does not properly enforce secure permissions for sub-directories within the non-default installation path, creating potential attack vectors for local adversaries.
The technical nature of this vulnerability stems from improper access control implementation within the Nessus Agent installation routine. When users specify non-default installation paths for the Nessus Agent on Windows systems, the software fails to establish appropriate permission controls for the various sub-directories it creates during deployment. This misconfiguration allows local users with lower privileges to potentially gain elevated access to system resources. The vulnerability operates under the principle that proper file system permissions should be enforced regardless of installation location, ensuring that sensitive components remain protected from unauthorized access. This flaw aligns with CWE-732: Incorrect Permission Assignment for Critical Resource, which specifically addresses situations where critical system resources receive inadequate access controls.
The operational impact of this vulnerability extends beyond simple privilege escalation capabilities, as it can enable attackers to gain unauthorized access to system resources that should remain protected. Local privilege escalation vulnerabilities are particularly concerning because they can be exploited by adversaries who have already gained some level of access to the system, potentially allowing them to move laterally or establish persistence. The attack surface is expanded when users deploy software to non-standard locations, as these directories may not be properly secured or monitored by standard system security controls. This vulnerability can be particularly dangerous in enterprise environments where multiple users may have access to shared systems or where standard security practices may not be consistently applied across all installation paths.
Mitigation strategies for this vulnerability should focus on immediate software updates to Nessus Agent version 10.8.3 or later, which addresses the permission enforcement issue. System administrators should conduct thorough audits of existing Nessus Agent installations to identify any non-default locations that may be affected by this vulnerability. The remediation process should include proper permission configuration for all directories created by the Nessus Agent installation, ensuring that only authorized users and processes can access sensitive components. Organizations should implement regular security assessments to verify that permission settings remain properly configured, particularly for software installed in non-standard locations. Additionally, security monitoring should be enhanced to detect any unauthorized access attempts to directories associated with Nessus Agent installations, as outlined in the attack techniques documented under the MITRE ATT&CK framework for privilege escalation and persistence mechanisms.