Critical severity · published Jul 22, 2024
CVE-2024-6806
Missing Authorization Checks In NI VeriStand Gateway For Project Resources
9.8
CVSS
1%
EPSS
No
On KEV
Description
The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)1.0% · higher than 63% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
VE
VeriStand · NI
through 24.2 · source: vendor, NVD, CISA
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2024-6806
CVE.org
https://www.cve.org/CVERecord?id=CVE-2024-6806
Vendor Advisory
https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html
More from VeriStand
9.8
CVE-2024-6805
Missing Authorization Checks in NI VeriStand Gateway for File Transfer Resources
9.8
CVE-2024-6794
Deserialization of Untrusted Data in NI VeriStand Waveform Streaming Server
9.8
CVE-2024-6793
Deserialization of Untrusted Data in NI VeriStand DataLogging Server
7.8
CVE-2024-6791
Directory Path Traversal Vulnerability in NI VeriStand with vsmodel Files
7.8
CVE-2024-6675
Deserialization of Untrusted Data Vulnerability in NI VeriStand Project File