Vulnerability identifier: #VU86933

Vulnerability risk: Low

CVSSv3.1: 6.8 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]

CVE-ID: CVE-2024-1155

CWE-ID: CWE-276

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
FlexLogger
Other software / Other software solutions
SystemLink Server
Other software / Other software solutions
G Web Development Software
Other software / Other software solutions
Static Test Software Suite
Other software / Other software solutions
LabVIEW NXG Web Module
Other software / Other software solutions
LabVIEW NXG Real-Time Module
Other software / Other software solutions
LabVIEW NXG Community Edition
Other software / Other software solutions
Data Record AD
Other software / Other software solutions
STS Software Bundle
Other software / Other software solutions
Specification Compliance Manager
Other software / Other software solutions

Vendor: National Instruments

Description

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to incorrect default permissions within the userservices executable and TagHistorian, DocumentManager, SkylineService, ServiceRegistry components. A local user with access to the system can view contents of files and directories or modify them.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

FlexLogger: 2022 Q3

SystemLink Server: 2023 Q3

G Web Development Software: 2022 Q3

Static Test Software Suite: 1.2

LabVIEW NXG Web Module: 5.1

LabVIEW NXG Real-Time Module: 5.1

LabVIEW NXG Community Edition: 5.1

Data Record AD: 2.0.1

STS Software Bundle: 21.0

Specification Compliance Manager: 2023 Q4

---

External links
http://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html
http://www.zerodayinitiative.com/advisories/ZDI-24-213/
http://www.zerodayinitiative.com/advisories/ZDI-24-212/
http://www.zerodayinitiative.com/advisories/ZDI-24-211/
http://www.zerodayinitiative.com/advisories/ZDI-24-210/
http://www.zerodayinitiative.com/advisories/ZDI-24-209/

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.