CVE-2025-36632

Executive Summary

CVE-2025-36632 is a privilege escalation vulnerability in Tenable Agent versions prior to 10.8.5 running on Windows hosts. A non-administrative user can exploit this flaw to execute arbitrary code with SYSTEM privileges, the highest level of access on a Windows system. This vulnerability poses a critical risk to enterprise environments where Tenable Agent is deployed for vulnerability scanning and asset management. Successful exploitation allows an attacker to gain complete control over the affected host, potentially leading to lateral movement, data exfiltration, or deployment of persistent backdoors. The vulnerability is currently unpatched for versions below 10.8.5, and no public proof-of-concept (PoC) or exploit code has been released.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Windows agent from Tenable. The supply chain risk is limited to the integrity of the Tenable Agent installation package and update mechanism. Organizations should ensure they download updates only from official Tenable sources and verify digital signatures.

CVSS Breakdown & Threat Level

CVSS Score: 7.8 (High)

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (L) – The attacker must have local access to the Windows host.
• Attack Complexity (AC): Low (L) – No special conditions are required for exploitation.
• Privileges Required (PR): Low (L) – The attacker needs only a non-administrative user account.
• User Interaction (UI): None (N) – No user action is required beyond the attacker's own actions.
• Scope (S): Unchanged (U) – The vulnerability does not affect components beyond the vulnerable agent.
• Confidentiality (C): High (H) – Full system compromise allows access to all data.
• Integrity (I): High (H) – The attacker can modify system files and configurations.
• Availability (A): High (H) – The attacker can disrupt system operations.

Threat Level: High. The low attack complexity and low privileges required make this a serious threat, especially in environments where users have local access to workstations or servers.

Deep Dive & Mechanics

The vulnerability resides in the Tenable Agent service, which runs with SYSTEM privileges on Windows. The flaw likely stems from improper handling of inter-process communication (IPC) or a service that allows a low-privileged user to trigger actions that execute in the context of the SYSTEM account. Common patterns for such vulnerabilities include:

• Insecure Named Pipes: The agent may create a named pipe that a low-privileged user can write to, and the service reads from it and executes commands without proper validation.
• Unquoted Service Path: If the service path contains spaces and is not quoted, a low-privileged user could place a malicious executable in a location that Windows will execute with SYSTEM privileges.
• DLL Hijacking: The agent may load a DLL from a path writable by a low-privileged user.
• Weak Service Permissions: The service may allow a low-privileged user to modify its configuration or binary.

Given the lack of public technical details, the exact mechanism is unknown. However, the impact is clear: a non-admin user can escalate to SYSTEM.

Vulnerable vs. Patched Code

No specific code snippets are available for this vulnerability. The patch (version 10.8.5) likely addresses the insecure IPC or service configuration. The following is a hypothetical example of the vulnerable pattern:

Vulnerable (Hypothetical):

// Insecure named pipe server running as SYSTEM
NamedPipeServerStream pipeServer = new NamedPipeServerStream("TenableAgentPipe", PipeDirection.InOut, 1);
pipeServer.WaitForConnection();
StreamReader reader = new StreamReader(pipeServer);
string command = reader.ReadLine();
// No impersonation or validation - executes command as SYSTEM
Process.Start("cmd.exe", "/c " + command);

Patched (Hypothetical):

// Secure named pipe server with impersonation
NamedPipeServerStream pipeServer = new NamedPipeServerStream("TenableAgentPipe", PipeDirection.InOut, 1, PipeTransmissionMode.Byte, PipeOptions.None);
pipeServer.WaitForConnection();
// Impersonate the client to validate permissions
pipeServer.RunAsClient(() => {
    StreamReader reader = new StreamReader(pipeServer);
    string command = reader.ReadLine();
    // Validate command against a whitelist
    if (IsAllowedCommand(command)) {
        Process.Start("cmd.exe", "/c " + command);
    }
});

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

1. Environment: Windows 10/11 or Windows Server 2016/2019/2022 virtual machine.
2. Vulnerable Software: Install Tenable Agent version 10.8.4 or earlier.
3. User Account: Create a local non-administrative user account (e.g., testuser).

Exploitation Steps (Hypothetical): Since no public exploit exists, the following is a generic approach for a named pipe vulnerability:

1. Identify the Pipe: Use tools like PipeList (Sysinternals) or PowerShell to enumerate named pipes created by the Tenable Agent service.

   Get-ChildItem \\.\pipe\ | Where-Object { $_.Name -like "*Tenable*" }
   

2. Connect to the Pipe: Write a simple C# or PowerShell script to connect to the pipe and send a malicious command.

   $pipe = New-Object System.IO.Pipes.NamedPipeClientStream(".", "TenableAgentPipe", [System.IO.Pipes.PipeDirection]::InOut)
   $pipe.Connect()
   $writer = New-Object System.IO.StreamWriter($pipe)
   $writer.WriteLine("net user attacker Password123! /add && net localgroup Administrators attacker /add")
   $writer.Flush()
   $pipe.Close()
   

3. Verify Privilege Escalation: After execution, the attacker user should be added to the local Administrators group.

Blue Team (Defensive)

Detection & Prevention:

1. Monitor Named Pipe Creation: Use Sysmon Event ID 17 (Pipe Created) and Event ID 18 (Pipe Connected) to detect suspicious pipe activity.
   • Look for pipes named TenableAgentPipe or similar.
   • Alert on connections from non-SYSTEM processes.
2. Audit Service Permissions: Regularly audit the Tenable Agent service permissions using tools like sc.exe sdshow or Process Explorer.

   sc sdshow "Tenable Agent"
   

   • Ensure that only SYSTEM and Administrators have write/modify permissions.
3. Enable Windows Defender Attack Surface Reduction (ASR) Rules:
   • Rule: "Block process creations originating from PSExec and WMI commands" (GUID: d1e49aac-8f56-4280-b9ba-993a6d77406c)
   • Rule: "Block executable files from running unless they meet a prevalence, age, or trusted list criterion" (GUID: 01443614-cd74-433a-b99e-2ecdc07bfc25)
4. Application Control: Use AppLocker or Windows Defender Application Control (WDAC) to prevent unauthorized executables from running, especially from user-writable paths.

Indicators of Compromise (IOCs)

• File Hashes (SHA-256): (None available publicly; monitor for modified Tenable Agent binaries)
• Named Pipe: \\.\pipe\TenableAgentPipe (or similar)
• Process Creation: cmd.exe or powershell.exe spawned by TenableAgent.exe with unusual arguments (e.g., adding users, modifying groups).
• Registry Changes: Modifications to HKLM\SYSTEM\CurrentControlSet\Services\Tenable Agent (e.g., ImagePath change).
• Network Connections: Outbound connections from TenableAgent.exe to unexpected IPs (if the exploit downloads a payload).
• Event Logs:
  • Security Event ID 4688: Process creation with TenableAgent.exe as parent and cmd.exe or powershell.exe as child.
  • Sysmon Event ID 1: Process creation with command-line arguments containing net user, net localgroup, or wmic.
  • Sysmon Event ID 17/18: Named pipe creation/connection events for TenableAgentPipe.

Detection Engineering

YARA Rule

rule CVE_2025_36632_Tenable_Agent_EoP {
    meta:
        description = "Detects potential exploitation of CVE-2025-36632 in Tenable Agent"
        author = "Valters IT"
        date = "2025-04-10"
        hash = "unknown"
    strings:
        $pipe_name = "TenableAgentPipe" ascii wide nocase
        $service_name = "Tenable Agent" ascii wide nocase
        $cmd_exec = "cmd.exe" ascii wide nocase
        $net_cmd = "net user" ascii wide nocase
    condition:
        (uint16(0) == 0x5A4D) and // MZ header
        (
            ($pipe_name and $cmd_exec) or
            ($service_name and $net_cmd)
        )
}

Sigma Rule

title: CVE-2025-36632 Tenable Agent Privilege Escalation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects suspicious process creation from Tenable Agent service
author: Valters IT
date: 2025/04/10
tags:
    - attack.privilege_escalation
    - attack.t1068
    - cve.2025.36632
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage|endswith: '\TenableAgent.exe'
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
            - '\wmic.exe'
    condition: selection
falsepositives:
    - Legitimate administrative actions via Tenable Agent
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-36632 Tenable Agent Potential C2 Beacon"; flow:to_server,established; content:"|16 03 01|"; depth:3; content:"Tenable"; nocase; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder for detecting potential C2 traffic from a compromised Tenable Agent. Adjust based on actual threat intelligence.

Remediation & Mitigation

Immediate Actions:

1. Upgrade: Update Tenable Agent to version 10.8.5 or later on all Windows hosts. This is the only definitive fix.
2. Restrict Local Access: Limit the number of users with local logon rights to Windows hosts running the vulnerable agent.
3. Monitor: Implement the detection rules above to identify any exploitation attempts.

Long-Term Mitigations:

1. Least Privilege: Ensure all users operate with the minimum privileges necessary.
2. Application Whitelisting: Use AppLocker or WDAC to block unauthorized executables.
3. Regular Auditing: Periodically audit service permissions and named pipe configurations.
4. Patch Management: Maintain a robust patch management process for all software, including security agents.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions or further analysis, contact your Valters IT representative.