CVE-2025-15313
📋 TL;DR
CVE-2025-15313 is an arbitrary file deletion vulnerability in Tanium EUSS that allows authenticated attackers to delete files on the server. This affects organizations using Tanium EUSS for endpoint management. Attackers could disrupt operations by deleting critical system or configuration files.
💻 Affected Systems
- Tanium Endpoint User Self Service (EUSS)
📦 What is this software?
Euss by Tanium
Euss by Tanium
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through deletion of critical OS files, leading to system crashes, data loss, or service disruption across managed endpoints.
Likely Case
Targeted deletion of configuration files causing service disruption, loss of audit logs, or removal of security controls on affected Tanium servers.
If Mitigated
Limited impact with proper access controls and monitoring, potentially only affecting non-critical files in isolated directories.
🎯 Exploit Status
Exploitation requires authenticated access to the Tanium EUSS interface. The vulnerability is in improper path validation allowing directory traversal.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version containing fix TAN-2025-010
Vendor Advisory: https://security.tanium.com/TAN-2025-010
Restart Required: Yes
Instructions:
1. Log into Tanium Console. 2. Navigate to Administration > Updates. 3. Apply the latest Tanium platform update containing TAN-2025-010. 4. Restart Tanium services as prompted.
🔧 Temporary Workarounds
Restrict EUSS Access
allLimit access to Tanium EUSS interface to only necessary administrative users
Implement File Integrity Monitoring
allDeploy FIM on Tanium server to detect unauthorized file deletions
🧯 If You Can't Patch
- Implement strict access controls to Tanium EUSS interface
- Deploy file integrity monitoring on Tanium server directories
🔍 How to Verify
Check if Vulnerable:
Check Tanium version against advisory TAN-2025-010. If running version prior to the fix, system is vulnerable.Check Version:
On Tanium server: tanium versionVerify Fix Applied:
Verify Tanium platform version includes TAN-2025-010 fix by checking version in Tanium Console > About.📡 Detection & Monitoring
Log Indicators:
- Unexpected file deletion events in Tanium audit logs
- Failed file access attempts with path traversal patterns
Network Indicators:
- Unusual volume of file operation requests to Tanium EUSS endpoints
SIEM Query:
source="tanium" AND (event_type="file_delete" OR event_type="file_remove") AND file_path CONTAINS ".."