Login Request a demo
Critical severity · published Jun 19, 2026
CVE-2026-9142
Insecure Default Credentials vulnerability in NI grpc-device when TLS configuration is not present
9.1
CVSS
0.4%
EPSS
No
On KEV
Description
There is an insecure default credentials vulnerability in NI grpc-device when TLS configuration is not present and the server is bound beyond loopback.  This may allow an unauthenticated user access to the server on the local network.  This affects NI grpc-device 2.17.0 and prior versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 38% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
InstrumentStudio · NI
through 26.3.0 · source: vendor, NVD
GR
grpc-device · NI
through 2.17.0 · source: vendor
NG
NI Grpc Device Server · NI
before 2.18.0 · source: NVD
Affected product
GR
grpc-device
NI
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-9142
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-9142
Vendor Advisory
https://github.com/ni/grpc-device/security/advisories/GHSA-fhhw-37q8-6562
Vendor Advisory
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/2026/multiple-vulnerabilities-in-ni-grpc-device-server.html
More from grpc-device
9.8
CVE-2026-48137
Untrusted pointer dereference in NI grpc-device sideband streaming API
7.5
CVE-2026-48141
Memory leak in NI grpc-device BeginSidebandStream
7.5
CVE-2026-48139
NULL pointer dereference vulnerability in NI grpc-device data moniker service
7.5
CVE-2026-48138
Out-of-bounds read vulnerability in the NI grpc-device streaming API
6.5
CVE-2026-48140
Unchecked enum cast vulnerability in NI grpc-device in BeginSidebandStream