A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.
An attacker sends a specially crafted network message containing a malicious payload to the Waveform Streaming Server. The server deserializes the received data without proper validation of its origin or content. As a result of this process, arbitrary code execution is possible in the context of the running server. The vulnerability is accessible remotely over the network without requiring any credentials.
Successful exploitation of this vulnerability allows an attacker to execute arbitrary code remotely (RCE) on the target system, which may lead to complete takeover of the machine, disclosure of sensitive data, and violation of system integrity and availability.
Patches available from the manufacturer should be applied in accordance with the references: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html
NI VeriStand 2024 Q2 and all earlier versions.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HNi Veristand
APPNi2024≤ 2024
Related vulnerabilities
RCE przez niebezpieczną deserializację w NI VeriStand DataLogging Server
Brak weryfikacji autoryzacji w NI VeriStand Gateway — RCE
A directory path traversal vulnerability exists when loading a vsmodel file in NI VeriStand that may result in...
The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resour...
An incorrect permission assignment in the TopoGrafix DataPlugin for GPX could result in information disclosure...