CVE-2024-1683 is a high severity (CVSS 7.3) DLL injection flaw in the Tenable Identity Exposure Secure Relay. An authenticated, low privileged local attacker could modify application files on the host, override configuration and run new Secure Relay services. Tenable fixed it in Secure Relay version 3.59.4.
What's affected
Tenable advisory TNS-2024-03 says Tenable Identity Exposure Secure Relay version 3.59.4 addresses the issues. The same advisory also covers third party Envoy vulnerabilities, because 3.59.4 updates Envoy to version 1.29.1. Those are separate CVEs.
Severity differs between sources. The NVD record and the advisory both give 7.3 (high) for CVE-2024-1683 with a temporal score of 6.6, but the advisory labels the overall bulletin as Critical because the Envoy issues include scores up to 9.9. The vector in the record is CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:L. The NVD weakness is CWE-78 (OS command injection).
How to check if you're exposed
Check the version of the Secure Relay installed on each host. The Tenable release notes for Identity Exposure list 3.59.4 as dated 20 February 2024. Compare your installed version with that.
Also check who has local accounts on the relay host. The attacker described in the record is local and low privileged, so the first line of defense is limiting access to the host and watching file changes in the application directory.
What to do now
- Upgrade Tenable Identity Exposure Secure Relay to 3.59.4 or later from the Tenable Downloads Portal.
- Restrict local logon to the relay host to administrators.
- Monitor the application directory for file changes and unexpected new services.
- Review the other issues in TNS-2024-03 and confirm the Envoy update applied.
- Document both the CVE score and the bulletin label in your ticket.
Why it matters
DLL injection happens when an application loads a library from a place a lower privileged user can write to. The attacker places a library of their own, and the application runs it with its own rights. The defense is to protect application directories with correct file permissions and to load libraries only from trusted paths.
It is a local issue, so the risk depends on who can reach the host. It is not in the CISA Known Exploited Vulnerabilities catalog. Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a component tied to this CVE appears in your dependency manifests. The Gold directory keeps the record, severity and references in one place, and reachability analysis helps you separate code paths that can actually be hit from packages that are merely installed.
Quick check
Why does the advisory say Critical?
The bulletin covers several CVEs, including Envoy issues with higher scores. CVE-2024-1683 itself is rated 7.3.
Sources
Last reviewed: 19 October 2026.
