CVE-2025-36630

Published Jul 2, 2025

Last updated 14 days ago

Tenable Nessus

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-36630 is a vulnerability found in Tenable Nessus versions prior to 10.8.5 on Windows. It allows a non-administrative user to overwrite arbitrary local system files with log content at SYSTEM privilege. This improper privilege management in Nessus can be exploited through the Nessus logging mechanism. Successful exploitation of CVE-2025-36630 could lead to attackers tampering with critical system files, potentially causing system instability, privilege escalation, or denial of service. To address this vulnerability, Tenable has released Nessus versions 10.8.5 and 10.9.0.

Description: In Tenable Nessus versions prior to 10.8.5 on a Windows host, it was found that a non-administrative user could overwrite arbitrary local system files with log content at SYSTEM privilege.
Source: vulnreport@tenable.com
NVD status: Analyzed
Products: nessus

Risk scores

CVSS 3.1

Type: Primary
Base score: 7.1
Impact score: 5.2
Exploitability score: 1.8
Vector string: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H
Severity: HIGH

Weaknesses

vulnreport@tenable.com: CWE-269
nvd@nist.gov: NVD-CWE-noinfo

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:tenable:nessus:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "E18D5743-273C-46E4-8DC2-9505675EC484",
            "versionEndExcluding": "10.8.5"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.