CVE-2021-20135

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

Nessus versions 8.15.2 and earlier were found to contain a local privilege escalation vulnerability which could allow an authenticated, local administrator to run specific executables on the Nessus Agent host. Tenable has included a fix for this issue in Nessus 10.0.0. The installation files can be obtained from the Tenable Downloads Portal (https://www.tenable.com/downloads/nessus).

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected software

Vendor	Product	Versions
n/a	Nessus	Nessus 8.15.2 and earlier

References

https://www.tenable.com/security/tns-2021-18Vendor Advisory
https://www.tenable.com/security/tns-2021-18Vendor Advisory

Timeline

Published: Nov 3, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-201369.8ManageEngine Log360 Builds < 5235 are affected by an improper access control vulnerability allowing database configuration overwrite. An una CVE-2021-201376.1A reflected cross-site scripting vulnerability exists in the url parameter of the /cgi-bin/luci/site_access/ page on the Gryphon Tower route CVE-2021-201388.8An unauthenticated command injection vulnerability exists in multiple parameters in the Gryphon Tower router’s web interface at /cgi-bin/luc CVE-2021-201398.8An unauthenticated command injection vulnerability exists in the parameters of operation 3 in the controller_server service on Gryphon Tower CVE-2021-20144.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: PAM Auth Plugin). Supported versions that are affected are 5.7 CVE-2021-201408.8An unauthenticated command injection vulnerability exists in the parameters of operation 10 in the controller_server service on Gryphon Towe CVE-2021-201418.8An unauthenticated command injection vulnerability exists in the parameters of operation 32 in the controller_server service on Gryphon Towe CVE-2021-201428.8An unauthenticated command injection vulnerability exists in the parameters of operation 41 in the controller_server service on Gryphon Towe CVE-2021-201438.8An unauthenticated command injection vulnerability exists in the parameters of operation 48 in the controller_server service on Gryphon Towe CVE-2021-201448.8An unauthenticated command injection vulnerability exists in the parameters of operation 49 in the controller_server service on Gryphon Towe CVE-2021-201457.5Gryphon Tower routers contain an unprotected openvpn configuration file which can grant attackers access to the Gryphon homebound VPN networ CVE-2021-201469.8An unprotected ssh private key exists on the Gryphon devices which could be used to achieve root access to a server affiliated with Gryphon'