A flaw in Nessus’ handling of reverse DNS records during scans permits a remote, unauthenticated attacker to inject malicious SQL statements into the scan results database. This injection can lead to the unauthorized retrieval of scan report data. The weakness is a classic SQL injection, categorized under CWE-89.

All Nessus services from Tenable that perform reverse DNS lookups are affected, as the advisory does not specify version constraints or operating system limitations.

The vulnerability carries a CVSS score of 2.1, indicating low severity. EPSS data is unavailable, and the issue is not listed in CISA’s KEV catalog, suggesting limited exploitation activity to date. However, the attack requires the attacker to control reverse DNS records for a host that Nessus scans, a condition that is possible in environments where DNS records are not tightly managed. Once the injection is achieved, the attacker can read the contents of the database, enabling exfiltration of sensitive scan information. The overall risk is moderate, primarily driven by the potential for data exposure rather than system compromise.