CVE-2025-36630: Tenable Nessus Arbitrarily Overwrites System Files with Privilege Escalation

Overview

This blog post aims to provide an in-depth analysis of the CVE-2025-36630 vulnerability. This critical vulnerability affects Tenable Nessus versions prior to 10.8.5 on a Windows host. The vulnerability allows a non-administrative user to overwrite arbitrary local system files with log content at SYSTEM privilege. This represents a significant threat to the security of affected systems and can potentially lead to system compromise or data leakage. The vulnerability is especially concerning due to its high severity, with a CVSS score of 8.4 which indicates a high impact on confidentiality, integrity and availability.

Vulnerability Summary

CVE ID: CVE-2025-36630
Severity: High (8.4 CVSS score)
Attack Vector: Local
Privileges Required: Low
User Interaction: Required
Impact: Potential system compromise or data leakage

Affected Products

Product | Affected Versions

Tenable Nessus | Prior to 10.8.5

How the Exploit Works

The vulnerability is exploited by a non-administrative user who can overwrite arbitrary system files with the log content. This is possible because of inadequate control mechanisms within Tenable Nessus which incorrectly grants SYSTEM level privilege to non-administrative users. The overwritten files could contain sensitive data, which can result in data leakage or even a system compromise if critical system files are overwritten.

Conceptual Example Code

Here is a conceptual example of how the vulnerability might be exploited. This pseudocode demonstrates how a malicious user may overwrite a system file with log content:

# Assume the user has already logged in and gained non-administrative access
# The malicious user decides to overwrite a system file with log content
use Tenable Nessus;
select log_content from logs;
overwrite system_file with log_content;
# The system file is now overwritten with the log content at SYSTEM privilege

Note: The above code is a conceptual example and does not represent actual exploit code.

Mitigation Guidance

Users are strongly advised to install the vendor-supplied patch that addresses this vulnerability, which is available for Tenable Nessus version 10.8.5 and onwards. If patching is not immediately possible, the use of a Web Application Firewall (WAF) or Intrusion Detection System (IDS) can provide temporary mitigation by detecting and preventing the exploitation of this vulnerability. However, this is a stopgap measure and does not replace the need for patching. Regularly updating and patching software is a critical component of maintaining system security.