Nessus Network Monitor < 6.5.4 Multiple Vulnerabilities (TNS-2026-14)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(314931);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/05/15");

  script_cve_id(
    "CVE-2024-11614",
    "CVE-2025-3277",
    "CVE-2026-32776",
    "CVE-2026-32777",
    "CVE-2026-32778",
    "CVE-2026-33916",
    "CVE-2026-33937",
    "CVE-2026-33938",
    "CVE-2026-33939",
    "CVE-2026-33940",
    "CVE-2026-33941",
    "CVE-2025-13034",
    "CVE-2025-14017",
    "CVE-2025-14524",
    "CVE-2025-14819",
    "CVE-2025-15079",
    "CVE-2025-15224",
    "CVE-2025-29087",
    "CVE-2025-29088"
  );

  script_name(english:"Nessus Network Monitor < 6.5.4 Multiple Vulnerabilities (TNS-2026-14)");

  script_set_attribute(attribute:"synopsis", value:
"An instance of Tenable NNM installed on the remote system is affected by multiple vulnerabilities.");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version, the Nessus Network Monitor running on the remote host is prior to 6.5.4. It is,
therefore, affected by multiple vulnerabilities as referenced in the TNS-2026-14 advisory.

  - An integer overflow can be triggered in SQLite's `concat_ws()` function. The resulting, truncated integer
    is then used to allocate a buffer. When SQLite then writes the resulting string to the buffer, it uses the
    original, untruncated size and thus a wild Heap Buffer overflow of size ~4GB can be triggered. This can
    result in arbitrary code execution. (CVE-2025-3277)

  - When using `CURLOPT_PINNEDPUBLICKEY` option with libcurl or `--pinnedpubkey` with the curl tool,curl
    should check the public key of the server certificate to verify the peer. This check was skipped in a
    certain condition that would then make curl allow the connection without performing the proper check, thus
    not noticing a possible impostor. To skip this check, the connection had to be done with QUIC with ngtcp2
    built to use GnuTLS and the user had to explicitly disable the standard certificate verification.
    (CVE-2025-13034)

  - When doing multi-threaded LDAPS transfers (LDAP over TLS) with libcurl, changing TLS options in one thread
    would inadvertently change them globally and therefore possibly also affect other concurrently setup
    transfers. Disabling certificate verification for a specific transfer could unintentionally disable the
    feature for other threads as well. (CVE-2025-14017)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
  # https://docs.tenable.com/release-notes/Content/network-monitor/2026.htm
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?a3b0825c");
  script_set_attribute(attribute:"see_also", value:"https://www.tenable.com/security/TNS-2026-14");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Nessus Network Monitor 6.5.4 or later.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
  script_set_cvss_temporal_vector("CVSS2#E:POC/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:P/RL:O/RC:C");
  script_set_attribute(attribute:"cvss4_vector", value:"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L");
  script_set_attribute(attribute:"cvss4_threat_vector", value:"CVSS:4.0/E:P");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-3277");

  script_set_attribute(attribute:"exploitability_ease", value:"Exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"true");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/08/18");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/05/14");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/05/15");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:tenable:nnm");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("nnm_installed_win.nbin", "nnm_installed_nix.nbin");
  script_require_keys("installed_sw/Tenable NNM", "Host/nnm_installed");

  exit(0);
}
include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Tenable NNM', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'fixed_version': '6.5.4'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_HOLE);
vdf::handle_check_and_report_errors(vdf_result:result);