HIGH🇵🇱 Wersja polska

CVE-2023-4570

CVSS 8.8v3.1pub. 2023-10-05upd. 2024-11-21

An improper access restriction in NI MeasurementLink Python services could allow an attacker on an adjacent network to reach services exposed on localhost. These services were previously thought to be unreachable outside of the node. This affects measurement plug-ins written in Python using version 1.1.0 of the ni-measurementlink-service Python package and all previous versions.

CVSS Vector

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ni Measurementlink
APP
Ni
1.0.0 – 1.1.1 (excl.)

🔵

CHECK WITH VENDOR

No clear patch data available. Check vendor references.

CWE

References

www.ni.com/en/support/documentation/supplemental/23/imp…

www.ni.com/en/support/documentation/supplemental/23/imp…

Related vulnerabilities

CVE-2026-9142CRITICAL9.3PL ✓same vendor

Brak uwierzytelnienia w NI grpc-device przy konfiguracji bez TLS

CVE-2026-48137CRITICAL9.3PL ✓same vendor

RCE przez untrusted pointer dereference w NI grpc-device sideband streaming API

CVE-2024-6793CRITICAL9.8PL ✓same vendor

RCE przez niebezpieczną deserializację w NI VeriStand DataLogging Server

CVE-2024-6806CRITICAL9.8PL ✓same vendor

Brak weryfikacji autoryzacji w NI VeriStand Gateway — RCE

CVE-2024-6794CRITICAL9.8PL ✓same vendor

RCE przez deserializację danych w NI VeriStand Waveform Streaming Server