Multiple vulnerabilities in National Instruments products

1) Incorrect default permissions

EUVDB-ID: #VU86932

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1156

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions within the configuration of RabbitMQ. A local user with access to the system can view contents of files and directories or modify them.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

FlexLogger: 2022 Q3

SystemLink Server: 2023 Q3

G Web Development Software: 2022 Q3

Static Test Software Suite: 1.2

LabVIEW NXG Web Module: 5.1

LabVIEW NXG Real-Time Module: 5.1

LabVIEW NXG Community Edition: 5.1

Data Record AD: 2.0.1

STS Software Bundle: 21.0

Specification Compliance Manager: 2023 Q4

External links

http://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html
http://www.zerodayinitiative.com/advisories/ZDI-24-214/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Incorrect default permissions

EUVDB-ID: #VU86933

Risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1155

CWE-ID: CWE-276 - Incorrect Default Permissions

Exploit availability: No

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions within the userservices executable and TagHistorian, DocumentManager, SkylineService, ServiceRegistry components. A local user with access to the system can view contents of files and directories or modify them.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

FlexLogger: 2022 Q3

SystemLink Server: 2023 Q3

G Web Development Software: 2022 Q3

Static Test Software Suite: 1.2

LabVIEW NXG Web Module: 5.1

LabVIEW NXG Real-Time Module: 5.1

LabVIEW NXG Community Edition: 5.1

Data Record AD: 2.0.1

STS Software Bundle: 21.0

Specification Compliance Manager: 2023 Q4

External links

http://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html
http://www.zerodayinitiative.com/advisories/ZDI-24-213/
http://www.zerodayinitiative.com/advisories/ZDI-24-212/
http://www.zerodayinitiative.com/advisories/ZDI-24-211/
http://www.zerodayinitiative.com/advisories/ZDI-24-210/
http://www.zerodayinitiative.com/advisories/ZDI-24-209/

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.