CVE-2025-24914

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

When installing Nessus to a non-default location on a Windows host, Nessus versions prior to 10.8.4 did not enforce secure permissions for sub-directories. This could allow for local privilege escalation if users had not secured the directories in the non-default installation location. - CVE-2025-24914

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

No affected versions have been published.

Timeline

Published: Apr 18, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-249157.8When installing Nessus Agent to a non-default location on a Windows host, Nessus Agent versions prior to 10.8.3 did not enforce secure permi CVE-2025-249167.8When installing Tenable Network Monitor to a non-default location on a Windows host, Tenable Network Monitor versions prior to 6.5.1 did not CVE-2025-249177.8In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could stage files in a loc CVE-2025-249186.7Improper link resolution before file access ('link following') for some Intel(R) Server Configuration Utility software and Intel(R) Server F CVE-2025-249198.1A deserialization of untrusted input vulnerability exists in the cvhDecapsulateCmd functionality of Dell ControlVault3 prior to 5.15.10.14 a CVE-2025-24929.2An improper authentication control vulnerability exists in AiCloud. This vulnerability can be triggered by a crafted request, potentially le CVE-2025-249204.3Mattermost versions 10.4.x <= 10.4.2, 10.3.x <= 10.3.3, 9.11.x <= 9.11.8, 10.5.x <= 10.5.0 fail to restrict bookmark creation and updates in CVE-2025-249216.6Improper neutralization for some Edge Orchestrator software before version 24.11.1 for Intel(R) Tiber(TM) Edge Platform may allow an unauthe CVE-2025-249228.8A stack-based buffer overflow vulnerability exists in the securebio_identify functionality of Dell ControlVault3 prior to 5.15.10.14 and De CVE-2025-249236.7Uncontrolled search path in some Intel(R) AI for Enterprise Retrieval-augmented Generation software may allow an authenticated user to poten CVE-2025-249249.8Certain functionality within GMOD Apollo does not require authentication when passed with an administrative username CVE-2025-249255.5in OpenHarmony v5.0.3 and prior versions allow a local attacker case DOS through missing release of memory.