EUVD-2025-18277
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
Lifecycle Timeline
3Description
In Tenable Agent versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
Analysis
Privilege escalation vulnerability in Tenable Agent for Windows (versions prior to 10.8.5) that allows non-administrative users to overwrite arbitrary system files with log content while executing at SYSTEM privilege level. This vulnerability enables local attackers without admin rights to achieve arbitrary file write operations with elevated privileges, potentially leading to system compromise. The vulnerability has a CVSS score of 8.4 (High) and affects Windows deployments; patch availability exists in version 10.8.5 and later.
Technical Context
This vulnerability stems from improper privilege management (CWE-269: Improper Access Control) in the Tenable Agent's logging mechanism on Windows platforms. The root cause involves the agent's log writing functionality failing to properly validate file paths or implement appropriate access controls when writing logs with elevated SYSTEM privileges. A non-administrative user can leverage this flaw to redirect or manipulate log output paths, causing arbitrary files on the system to be overwritten with log content while the write operation executes under SYSTEM context. The affected component is the Tenable Agent service running on Windows (CPE likely matching: cpe:2.3:a:tenable:tenable_agent:*:*:*:*:*:windows:*:*). The vulnerability exploits the trust boundary between user-mode code and privileged system operations without sufficient path validation or sandboxing.
Affected Products
Tenable Agent versions prior to 10.8.5 on Windows hosts. Specific affected versions: 10.8.4, 10.8.3, 10.8.2, 10.8.1, 10.8.0, and all earlier versions on Windows platforms. CPE: cpe:2.3:a:tenable:tenable_agent:*:*:*:*:*:windows:*:* (versions < 10.8.5). Fixed in: Tenable Agent 10.8.5 and later. Non-Windows deployments (Linux, macOS) are not affected by this specific vulnerability. Vendor: Tenable, Inc. Advisory reference: Tenable Security Advisory for CVE-2025-36631.
Remediation
Immediate action: Upgrade Tenable Agent to version 10.8.5 or later on all affected Windows systems. Step-by-step remediation: (1) Identify all Windows endpoints running Tenable Agent versions prior to 10.8.5 using asset inventory or Tenable's own scanning tools; (2) Schedule maintenance windows for patching; (3) Download Tenable Agent 10.8.5+ from Tenable's official release repository; (4) Deploy via group policy, endpoint management tools (SCCM, Intune), or manual update; (5) Verify upgrade completion and agent health post-deployment. Interim mitigations (pre-patch): (1) Restrict local user account creation on Windows systems running Tenable Agent to trusted personnel only; (2) Disable or remove unnecessary local user accounts; (3) Monitor for suspicious log file modifications using Windows Auditing (enable object access auditing for sensitive system files); (4) Implement file integrity monitoring (FIM) solutions to detect unauthorized file changes. Vendor advisory and patch availability: Consult Tenable's official security advisory at https://www.tenable.com/security-advisories or contact Tenable support for the latest patch links and deployment guidance.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today