Nssm-2.24 Exploit __top__ -

The following hunt techniques can help uncover adversary use of NSSM:

A similar misconfiguration affected Apache CouchDB version 2.0.0 for Windows. Security researcher John Page (hyp3rlinx) discovered that the CouchDB installer set weak file permissions on the nssm.exe binary, granting the "Change" (C) flag to the Authenticated Users group:

The NSSM-2.24 exploit refers to a specific vulnerability in the Non-Sucking Service Manager (NSSM) version 2.24, a popular service manager for Windows. NSSM is widely used to manage and monitor services on Windows systems, providing a more robust and feature-rich alternative to the built-in Windows Service Manager. However, like any software, NSSM is not immune to vulnerabilities. The NSSM-2.24 exploit is a significant concern for system administrators and security professionals, as it can be leveraged to gain unauthorized access to systems, escalate privileges, and potentially lead to a complete system compromise.

NSSM version 2.24 was released on August 31, 2014. The primary purpose of NSSM is to start any application as an NT service and to automatically restart the service if it fails for any reason. Unlike the older srvany utility from Microsoft, NSSM provides a more reliable monitoring mechanism and a much friendlier configuration interface. nssm-2.24 exploit

Based on the NSSM-2.24 exploit, we recommend the following:

<EventID>1</EventID> <Data name="Image" condition="end with">nssm.exe</Data> <Data name="CommandLine" condition="contains">install</Data>

: An attacker gains low-privileged local access to the target system (e.g., through a compromised standard user account or a limited-access terminal server session). The following hunt techniques can help uncover adversary

The NSSM-2.24 exploit refers to a critical vulnerability discovered in the Non-Sucking Service Manager (NSSM) version 2.24. NSSM is a popular, open-source service manager for Windows that allows users to manage and monitor services on their systems. While NSSM is designed to provide a reliable and efficient way to handle services, the 2.24 version contains a vulnerability that can be exploited by attackers to gain unauthorized access to a system.

The vulnerability is caused by a flaw in the way NSSM handles service configuration files. Specifically, the vulnerability occurs when NSSM is configured to use a service configuration file that is not properly validated. An attacker can exploit this vulnerability by creating a malicious service configuration file that, when loaded by NSSM, allows the attacker to gain elevated privileges.

The underlying weakness is the lack of authentication for a critical function. The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources. A vulnerability with such characteristics has broad implications for any system where an NSSM‑based service is installed with lax permissions—a scenario that is by no means limited to Phoenix Contact software. However, like any software, NSSM is not immune

There are no documented exploits for NSSM version 2.24 itself. However,

| Date | Event | |------|-------| | August 12, 2025 | Vulnerability published and coordinated by CERT@VDE | | August 12, 2025 | NVD publishes first CVSS score of 7.8 | | August 14, 2025 | Red Hat Security Advisory released |

There are ways to mitigate the NSSM-2.24 vulnerability: