CVE-2020-5794
CVE-2020-5794 is a high-severity vulnerability in Tenable Nessus Network Monitor with a CVSS 3.x base score of 7.8. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low.
Key facts
- Severity: High (CVSS 3.x base score 7.8)
- CVSS v2: 4.6
- EPSS exploit prediction: 0% (28th percentile)
- Actively exploited: Not listed in CISA KEV
- Affected product: Tenable Nessus Network Monitor
- Published:
- Last modified:
Description
A vulnerability in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows could allow an authenticated local attacker to execute arbitrary code by copying user-supplied files to a specially constructed path in a specifically named user directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability.
Frequently asked questions
- What is CVE-2020-5794?
- A vulnerability in Nessus Network Monitor versions 5.11.0, 5.11.1, and 5.12.0 for Windows could allow an authenticated local attacker to execute arbitrary code by copying user-supplied files to a specially constructed path in a specifically named user directory. The attacker needs valid credentials on the Windows system to exploit this vulnerability.
- How severe is CVE-2020-5794?
- CVE-2020-5794 has a CVSS 3.x base score of 7.8, rated high severity. It is exploitable over local access with low attack complexity, requires low privileges and no user interaction. Impact on confidentiality is high, integrity high, and availability high.
- Is CVE-2020-5794 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 0% (28th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2020-5794?
- CVE-2020-5794 primarily affects Tenable Nessus Network Monitor. In total, 3 product configurations (CPEs) are listed as vulnerable; see the affected-products list for the exact versions.
- How do I fix CVE-2020-5794?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround. Given its high severity, prioritise patching exposed systems.
- When was CVE-2020-5794 published?
- CVE-2020-5794 was published on 2020-11-06 and last updated on 2026-06-17.
References
Affected products (3)
- cpe:2.3:a:tenable:nessus_network_monitor:5.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:tenable:nessus_network_monitor:5.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:tenable:nessus_network_monitor:5.12.0:*:*:*:*:*:*:*
More vulnerabilities in Tenable Nessus Network Monitor
- CVE-2021-3711 — Critical (CVSS 9.8): In order to decrypt SM2 encrypted data an application is expected to call the API function EVP_PKEY_decrypt().…
- CVE-2024-9158 — High (CVSS 8.4): A stored cross site scripting vulnerability exists in Nessus Network Monitor where an authenticated, privileged local…
- CVE-2025-24917 — High (CVSS 7.8): In Tenable Network Monitor versions prior to 6.5.1 on a Windows host, it was found that a non-administrative user could…
- CVE-2021-23840 — High (CVSS 7.5): Calls to EVP_CipherUpdate, EVP_EncryptUpdate and EVP_DecryptUpdate may overflow the output length argument in some…
- CVE-2021-3712 — High (CVSS 7.4): ASN.1 strings are represented internally within OpenSSL as an ASN1_STRING structure which contains a buffer holding the…
- CVE-2021-3450 — High (CVSS 7.4): The X509_V_FLAG_X509_STRICT flag enables additional security checks of the certificates present in a certificate chain.…