CVE-2024-1155: Incorrect permissions for shared NI SystemLink Elixir based services

High severity · published Feb 20, 2024

CVE-2024-1155

Incorrect permissions for shared NI SystemLink Elixir based services

7.8

CVSS

0.3%

EPSS

On KEV

Description

Incorrect permissions in the installation directories for shared SystemLink Elixir based services may allow an authenticated user to potentially enable escalation of privilege via local access.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.3% · higher than 20% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

FlexLogger · NI

through 2022 Q3 · source: vendor, NVD

SystemLink Server · NI

through 2023 Q3 · source: vendor, NVD

Data Record AD · Emerson

through 2.0.1 · source: NVD

G Web Development Software · Emerson

through 2022_q3 · source: NVD

Labview Nxg · Emerson

5.1; 5.1; 5.1 · source: NVD

Specification Compliance Manager · Emerson

through 2023_q4 · source: NVD

Static Test Software Suite · Emerson

through 1.2 · source: NVD

Sts Software Bundle · Emerson

through 21.0 · source: NVD

Affected product

FlexLogger

All FlexLogger CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2024-1155

CVE.org

https://www.cve.org/CVERecord?id=CVE-2024-1155

Exploit

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/incorrect-permissions-for-shared-systemlink-elixir-based-service.html