Critical severity · published Jul 22, 2024
CVE-2024-6806
The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources
9.8
CVSS
1%
EPSS
No
On KEV
Description
The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VE
Veristand · NI
through 2024; 2024 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6806
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6806
Vendor Advisory
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html
More from Veristand
9.8
CVE-2024-6805
The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources
9.8
CVE-2024-6794
A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution
9.8
CVE-2024-6793
A deserialization of untrusted data vulnerability exists in NI VeriStand DataLogging Server that may result in remote code execution
7.8
CVE-2024-6791
A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in remote code execution
5.5
CVE-2023-5136
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure