CVE-2025-24914 is a vulnerability identified in Tenable's Nessus vulnerability scanner software, specifically affecting versions prior to 10.8.4 when installed on Windows hosts in a non-default directory. The core issue stems from CWE-276, which relates to incorrect default permissions. During installation to a custom directory, Nessus fails to enforce secure permissions on sub-directories, potentially allowing unauthorized local users to modify files or directories within the Nessus installation path. This misconfiguration can be exploited for local privilege escalation, enabling a lower-privileged user to gain elevated rights on the affected system. The vulnerability does not require remote access or network exploitation; it is limited to local users who have some access to the host. No known exploits are currently reported in the wild, and no patches or updates are explicitly linked in the provided data, although the issue is fixed in versions 10.8.4 and later. The vulnerability was reserved in January 2025 and publicly disclosed in April 2025. Given that Nessus is widely used for vulnerability management and security auditing, the presence of this vulnerability could undermine the integrity and security of the host systems where it is installed, especially if the installation is customized to non-default paths without proper permission hardening.

For European organizations, the impact of CVE-2025-24914 can be significant in environments where Nessus is deployed on Windows systems with non-default installation paths. Since Nessus is a critical security tool used to identify vulnerabilities, a local privilege escalation vulnerability could allow malicious insiders or compromised local accounts to gain elevated privileges, potentially leading to unauthorized access to sensitive data, tampering with security configurations, or disabling security monitoring. This could degrade the overall security posture and increase the risk of further compromise. Organizations relying heavily on Nessus for compliance and security assurance may face operational disruptions or compliance issues if attackers exploit this vulnerability. The impact is particularly relevant for organizations with strict regulatory requirements (e.g., GDPR) where unauthorized privilege escalation could lead to data breaches and regulatory penalties. However, the vulnerability requires local access and does not appear to be exploitable remotely, limiting its scope to insider threats or attackers who have already gained some foothold.

Ensure Nessus installations on Windows hosts use the default installation path whenever possible to avoid the incorrect permission issue. If a non-default installation path is necessary, immediately verify and manually harden the permissions on all Nessus sub-directories to restrict write and modify access to only trusted administrative accounts. Upgrade Nessus installations to version 10.8.4 or later, where this vulnerability has been addressed by enforcing secure permissions during installation. Implement strict local user account management and monitoring to detect unauthorized privilege escalation attempts. Use endpoint detection and response (EDR) tools to monitor for suspicious activities related to file permission changes or privilege escalation on hosts running Nessus. Regularly audit file system permissions on critical security tools and their installation directories as part of security hygiene. Limit local administrative privileges and enforce the principle of least privilege to reduce the risk of exploitation by local users.