Forum Discussion
Unauthenticated check for Zerologon available Tenable has...
Unauthenticated check for Zerologon available Tenable has released Microsoft Netlogon Elevation of Privilege. This plugin attempts to authenticate to the target using an all zero client credential...
This isn't intended behavior for sure. The remediation scan exists to let users move a particular vulnerability to 'mitigated' without running a whole scan.
Please open up a support case at support.tenable.com and send this info to our support team. They'll want to grab some debug info from the scan to see why SecurityCenter isn't moving the vulnerability to mitigated.
Support will also need to know if these assets been patched. If they have, then the scan shouldn't be flagging those assets as vulnerable. If not, then that makes me think the remediation scan is failing to get a positive hit and incorrectly tagging a target as mitigated.
For some quick direct answers to your two questions
- If the scan is flagging a target as vulnerable, then the plugins were able to get a successful session through a real exploit attempt. If the remediation scan is marking a target as mitigated, then something about the nature of that scan is failing to exploit the target.
- That's not intended behavior. If regular scans are not showing a target as vulnerable, but also then not moving a vulnerability in your repository to mitigated, then SecurityCenter is mishandling the data it's getting back from your scanners for this plugin specifically.
