CVE Feed

    Dashboard / CVE / CVE-2025-24914

    CVE-2025-24914

    When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location. - CVE-2025-24914

    Published:Apr 18, 2025
    Last Modified:Apr 15, 2026
    EPS:Apr 18, 2025
    EPSS Score:0.00031
    CVSS Score:7.8

    Affected Products

    Vendor
    Tenable
    Product
    Nessus

    Exploits

    No exploit reference

    Common Weakness Enumeration

    CWE-276 Incorrect Default Permissions

    Related CVEs

    CVE-2026-57588 (CVSS 1.8) — A SQL injection vulnerability in Nessus allows an attacker to craft a malicious scan result file that, when im…
    CVE-2026-57587 (CVSS 2.9) — A SQL injection vulnerability in Nessus allows a remote, unauthenticated attacker who controls reverse DNS rec…
    CVE-2026-33694 (CVSS 7.4) — This vulnerability allows an attacker to create a junction, enabling the deletion of arbitrary files with SYST…
    CVE-2025-36630 (CVSS 8.4) — In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user coul…
    CVE-2025-36625 (CVSS 4.3) — In Nessus versions prior to 10.8.4, a non-authenticated attacker could alter Nessus logging entries by manipul…
    CVE-2024-3290 (CVSS 8.2) — A race condition vulnerability exists where an authenticated, local attacker on a Windows Nessus host could mo…
    CVE-2024-3289 (CVSS 7.8) — When installing Nessus to a directory outside of the default location on a Windows host, Nessus versions prior…
    CVE-2024-2390 (CVSS 7.8) — As a part of Tenable’s vulnerability disclosure program, a vulnerability in a Nessus plugin was identified an…
    CVE-2024-0971 (CVSS 6.5) — A SQL injection vulnerability exists where an authenticated, low-privileged remote attacker could potentially…
    CVE-2024-0955 (CVSS 4.8) — A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on th…

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High