CVE-2021-20117

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. This is different than CVE-2021-20118.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Nessus Agent	Nessus Agent 8.3.0 and earlier

References

https://www.tenable.com/security/tns-2021-15Patch, Vendor Advisory
https://www.tenable.com/security/tns-2021-15Patch, Vendor Advisory

Timeline

Published: Sep 9, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-201186.7Nessus Agent 8.3.0 and earlier was found to contain a local privilege escalation vulnerability which could allow an authenticated, local adm CVE-2021-201197.1The password change utility for the Arris SurfBoard SB8200 can have safety measures bypassed that allow any logged-in user to change the adm CVE-2021-20124.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Security: Privileges). Supported versions that are affected ar CVE-2021-201208.8The administration web interface for the Arris Surfboard SB8200 lacks any protections against cross-site request forgery attacks. This means CVE-2021-201214.0The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is vulnerable to an authenticated arbitrary file read. An authenticated CVE-2021-201227.2The Telus Wi-Fi Hub (PRV65B444A-S-TS) with firmware version 3.00.20 is affected by an authenticated command injection vulnerability in multi CVE-2021-201237.5A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the DownloadFileServlet e CVE-2021-201247.5A local file inclusion vulnerability exists in Draytek VigorConnect 1.6.0-B3 in the file download functionality of the WebServlet endpoint. CVE-2021-201259.8An arbitrary file upload and directory traversal vulnerability exists in the file upload functionality of DownloadFileServlet in Draytek Vig CVE-2021-201268.8Draytek VigorConnect 1.6.0-B3 lacks cross-site request forgery protections and does not sufficiently verify whether a well-formed, valid, co CVE-2021-201278.1An arbitrary file deletion vulnerability exists in the file delete functionality of the Html5Servlet endpoint of Draytek VigorConnect 1.6.0-CVE-2021-201285.4The Profile Name field in the floor plan (Network Menu) page in Draytek VigorConnect 1.6.0-B3 was found to be vulnerable to stored XSS, as u