Vulnerabilities > CVE-2024-6794 - Deserialization of Untrusted Data vulnerability in NI Veristand

CVSS 9.8 - CRITICAL

Attack vector

NETWORK

Attack complexity

LOW

Privileges required

NONE

Confidentiality impact

HIGH

Integrity impact

HIGH

Availability impact

HIGH

network

low complexity

CWE-502

critical

NVD

Published: 2024-07-22

Updated: 2024-09-17

Summary

A deserialization of untrusted data vulnerability exists in NI VeriStand Waveform Streaming Server that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.

Vulnerable Configurations

Part	Description	Count
Application	Ni NI Veristand 2024 NI Veristand 2013 NI Veristand 2014 NI Veristand 2015 NI Veristand 2016 NI Veristand 2017 NI Veristand 2018 NI Veristand 2019 NI Veristand 2020 NI Veristand 2021 NI Veristand 2023	26

Common Weakness Enumeration (CWE)

CWE-502 - Deserialization of Untrusted Data

References

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/deserialization-of-untrusted-data-vulnerabilities-in-ni-veristand.html