Read the docs
TI-2024-01564 Aliases CVE-2024-1683GHSA-3fhw-3rw6-474c

DLL Injection in Tenable Identity Exposure Secure Relay

Priority LOW 32CWE-78Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
None · High · Low
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-78.

Summary

A DLL injection vulnerability exists where an authenticated, low-privileged local attacker could modify application files on the TIE Secure Relay host, which could allow for overriding of the configuration and running of new Secure Relay services.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0031 23rd percentileScored 2026-11-07
Fix Fixed Tenable Identity Exposure Secure Relay (Tenable): 3.59.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
TenableTenable Identity Exposure Secure Relay3.42.17 to before 3.59.43.59.4Patch availableCNA
  • Tenable Identity Exposure Secure Relay VendorTenable Affected 3.42.17 to before 3.59.4 Fixed in 3.59.4 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:tenable:identity_exposure:*:*:*:*:*:*:*:*before 3.59.4VulnerableTenable
  • cpe:2.3:a:tenable:identity_exposure:*:*:*:*:*:*:*:* Versions before 3.59.4 Vulnerable ·Tenable

Remediation

  • Fix · CNA Tenable Identity Exposure Secure Relay (Tenable) Fixed in 3.59.4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-1683
  2. 2026-10-03 Alias added: GHSA-3fhw-3rw6-474c

References

Advisory 1

  • TI-2026-11066 Insecure Public Caching on REST API Endpoints in Tenable Identity Exposure CVSS 4.0HIGH 8.5
  • TI-2024-03030 Formula Injection Vulnerability CVSS 3.1HIGH 7.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences