by Kastro
Paper/Archive/CVE-2024-6806

CVE-2024-6806

NI VeriStand — Missing Authorization Checks In NI VeriStand Gateway For Project Resources

EPSS 1%CVSS 9.8
critical.is priorityof 100
42
CVSS 9.8 (CNA, NVD agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 63.4.634 × 2012.7No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.

Affected

ProductAffectedFixed inSource
VeriStand≤ 24.2–CNA
veristand≤ 24.2–CISA-ADP

Scores by source

NI (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

refni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html