by Kastro
Paper/Archive/CVE-2024-6805

CVE-2024-6805

NI VeriStand — Missing Authorization Checks in NI VeriStand Gateway for File Transfer Resources

EPSS 1.0%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (NVD)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 61.4.614 × 2012.3No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources. These missing checks may result in information disclosure or remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.

Affected

ProductAffectedFixed inSource
VeriStand≤ 24.2–CNA
veristand≤ 24.2–CISA-ADP

Scores by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NI (CNA)7.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html