CVE-2025-36636

Executive Summary

CVE-2025-36636 is an improper access control vulnerability in Tenable Security Center versions prior to 6.7.0. An authenticated user can exploit this flaw to access areas outside their authorized scope, potentially leading to unauthorized information disclosure. The vulnerability has a CVSS score of 4.3 (Medium), with a low EPSS score of 0.0%, indicating limited active exploitation in the wild. No public proof-of-concept (PoC) or exploit code is currently available. The vendor has not released a patch, but upgrading to version 6.7.0 is the recommended mitigation.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects the Tenable Security Center application, a proprietary security management platform.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: Low (authenticated user)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: None

The threat level is considered Medium due to the requirement for authentication and the limited impact (confidentiality only). However, the low attack complexity and network-based vector make it exploitable by any authenticated user.

Deep Dive & Mechanics

The vulnerability resides in the access control mechanisms of Tenable Security Center. Improper validation of user permissions allows an authenticated user to bypass authorization checks and access resources or functionalities that should be restricted. This could include viewing scan results, configurations, or other sensitive data belonging to other users or groups.

The root cause is a failure to enforce proper role-based access control (RBAC) checks on certain API endpoints or UI components. An attacker with a low-privileged account can craft requests to access higher-privileged areas, leading to unauthorized information disclosure.

Vulnerable vs. Patched Code

No specific code snippets are available for this CVE. The fix involves implementing proper access control checks in the affected components. In the patched version (6.7.0), the application validates user permissions before granting access to any resource, ensuring that users can only access data within their authorized scope.

Exploitation & Lab Setup

Red Team

Since no public exploit code is available, a red team would need to perform manual testing. The following steps outline a potential exploitation approach:

1. Setup: Deploy a vulnerable Tenable Security Center instance (version < 6.7.0) in a lab environment.
2. Authentication: Create a low-privileged user account.
3. Reconnaissance: Use the authenticated session to enumerate API endpoints and identify those that may lack proper access controls.
4. Exploitation: Craft HTTP requests to access restricted resources, such as:
   • Viewing scan results of other users.
   • Accessing administrative configurations.
   • Retrieving sensitive data from other tenants (if multi-tenancy is enabled).

Example request to test for improper access control:

curl -X GET "https://target.tld/rest/scanResults?scanID=123" \
  -H "Authorization: Bearer <low_priv_token>"

If the response returns data for a scan that the user should not have access to, the vulnerability is confirmed.

Blue Team

To detect exploitation attempts, monitor for:

• Unusual API requests from low-privileged users to high-privilege endpoints.
• Anomalous access patterns, such as a user accessing resources outside their typical scope.
• Failed authorization attempts followed by successful access to restricted resources.

Indicators of Compromise (IOCs)

• Network: HTTP requests to /rest/ endpoints with unexpected resource IDs from low-privileged users.
• Logs: Security Center audit logs showing access to restricted resources by unauthorized users.
• System: Unusual data exfiltration patterns from the Security Center database.

Detection Engineering

YARA Rule

rule CVE_2025_36636_AccessControl {
    meta:
        description = "Detects exploitation attempts for CVE-2025-36636"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-36636"
    strings:
        $s1 = "/rest/" ascii wide nocase
        $s2 = "scanID=" ascii wide nocase
        $s3 = "Authorization: Bearer" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: CVE-2025-36636 - Improper Access Control in Tenable Security Center
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects potential exploitation of CVE-2025-36636 by monitoring for unauthorized access to restricted API endpoints.
author: Valters IT
date: 2025-04-01
logsource:
    category: web
    product: tenable_security_center
detection:
    selection:
        http.method: 'GET'
        http.url|contains: '/rest/'
        http.response.status_code: 200
        user.privilege: 'low'
    condition: selection
falsepositives:
    - Legitimate access by authorized users
level: medium

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-36636 - Tenable Security Center Improper Access Control";
    flow:to_server,established;
    content:"/rest/"; http_uri;
    content:"Authorization: Bearer"; http_header;
    sid:1000001;
    rev:1;
    reference:cve,2025-36636;
    classtype:attempted-recon;
    priority:2;
)

Remediation & Mitigation

1. Upgrade: Immediately upgrade to Tenable Security Center version 6.7.0 or later.
2. Access Control Review: Audit user permissions and ensure least privilege principles are enforced.
3. Network Segmentation: Restrict access to the Security Center management interface to trusted networks only.
4. Monitoring: Enable detailed logging and monitor for suspicious access patterns.
5. Incident Response: If exploitation is suspected, investigate and contain the affected accounts.

Valters IT
DevSecOps & Cyber Threat Intelligence Expert