High severity · published Feb 20, 2024
CVE-2024-1155
Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via…
7.8
CVSS
0.3%
EPSS
No
On KEV
Description
Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access.
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.3% · higher than 20% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DR
Data Record AD · Emerson
through 2.0.1 · source: NVD
FL
Flexlogger · Emerson
through 2022_q3 · source: NVD
GW
G Web Development Software · Emerson
through 2022_q3 · source: NVD
LN
Labview Nxg · Emerson
5.1; 5.1; 5.1 · source: NVD
SC
Specification Compliance Manager · Emerson
through 2023_q4 · source: NVD
ST
Static Test Software Suite · Emerson
through 1.2 · source: NVD
SS
Sts Software Bundle · Emerson
through 21.0 · source: NVD
SS
Systemlink Server · Emerson
before 2024_q1 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-1155
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-1155
Exploit
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html
More from Data Record AD
7.8
CVE-2024-1156
Incorrect directory permissions for the shared NI RabbitMQ service may allow a local authenticated user to read RabbitMQ configuration information and potentially enable…