Two deserialization of untrusted data vulnerabilities exist in NI VeriStand that may result in remote code execution. Successful exploitation requires an attacker to send a specially crafted message. These vulnerabilities affect NI VeriStand 2024 Q2 and prior versions.
The vulnerability associated with the DataLogging Server is identified as CVE-2024-6793.
The vulnerability associated with the Waveform Streaming Server is identified as CVE-2024-6794.
NI strongly recommends upgrading the affected software to mitigate this vulnerability. Refer to the Affected Products section for information on upgrading these products.
CVE-2024-6793 – 9.8 - CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE-2024-6794 – 9.8 - CVSS:3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
At NI, we view the security of our products as an important part of our commitment to our customers. Go to ni.com/security to stay informed and act upon security alerts and issues.
NI would like to thank kimiya working with Trend Micro Zero Day Initiative for reporting this issue and working with us on coordinated disclosure.
| Product Version | Mitigation |
|---|---|
| VeriStand 2024 | Upgrade to NI VeriStand 2024 Q3 or later from NI Package Manager or Software Downloads |
| VeriStand 2023 | Upgrade to NI VeriStand 2023 Q4 Patch 1 or later from NI Package Manager or Software Downloads |
| VeriStand 2021 | Upgrade to NI VeriStand 2021 R3 Patch 2 or later from NI Package Manager or Software Downloads |
| VeriStand 2020 and prior | Not in Mainstream Support |