Tenable Security Center Command Injection Vulnerability Allowing Arbitrary Code Execution

A command injection vulnerability has been identified in Tenable Security Center, allowing authenticated, remote attackers to execute arbitrary code on the server hosting the application. This vulnerability affects Security Center versions 6.7.2 and earlier.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of commands on the server, potentially allowing attackers to execute arbitrary code with the same privileges as the application.

Remediation

Tenable has released patches SC-202602.1 and SC-202602.2 to address this vulnerability. The patch SC-202602.1 can be applied to Tenable Security Center versions 6.5.1, 6.6.0, and 6.7.2. The patch SC-202602.2 is available for all affected versions. The installation files for both patches can be obtained from the Tenable Downloads Portal.