Home Support Security

Incorrect Default Directory Permissions for NI SystemLink Redis Service

Created Jul 22, 2024

Overview

An incorrect permission in the installation directory for the shared NI SystemLink Server KeyValueDatabase service may result in information disclosure via local access.  This affects NI SystemLink Server 2024 Q1 and prior versions.  It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.    

 

This vulnerability is identified as CVE-2024-6122.

Contents

Mitigation Guidance

NI strongly recommends upgrading the affected software to fix this vulnerability.  Refer to the Affected Products section to download the update.  If upgrading is not possible, this issue may be mitigated using the following methods.

 

Using Windows Explorer

  1. Navigate to <ProgramData>\National Instruments\Skyline\
  2. Right-click on the folder KeyValueDatabase and select Properties. 
  3. In the Properties window, go to the Security tab
  4. Click Advanced
  5. Click Change Permissions. 
  6. Click Disable inheritance.
  7. When prompted, choose Convert inherited permissions into explicit permissions on this object.
  8. In the “Permission entries” list, select all instances of Users and Authenticated Users and click Remove on each.
  9. Click the OK button
  10. Reboot the server

 

FlexLogger versions 2023 Q3 and later no longer depend on the NI SystemLink KeyValue Database Service, which includes Redis. To remove Redis from an older FlexLogger system after upgrade:

  1. Open NI Package Manager
  2. Under Settings, check "Show full version numbers and hidden packages"
  3. Click the INSTALLED tab to view all installed packages
  4. Search installed packages for "redis" (press ENTER key after typing in the search field)
  5. Confirm that FlexLogger is NOT included in the list of additional packages that will be removed
  6. Check “NI SystemLink KeyValue Database Service” and press the Remove button
Back to top

Affected Products

 

Back to top

CVSS Score

CVE-2024-6122– 5.5 - CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N 

Back to top

Further Information

At NI, we view the security of our products as an important part of our commitment to our customers.  Go to ni.com/security to stay informed and act upon security alerts and issues.

Back to top

Acknowledgements

NI would like to thank 06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with Trend Micro Zero Day Initiative for reporting this issue and working with us on coordinated disclosure.

Back to top

Additional Resources

Back to top
Product VersionMitigation
SystemLink Server 2024 Q1 and prior versions Upgrade to SystemLink Server 2024 Q1 Patch 2 or later via NI Package Manager or from Software Downloads   
FlexLogger 2023 Q2 and prior versionsIf NI SystemLink Server is installed:

Upgrade to SystemLink Server 2024 Q1 Patch 2 or later via NI Package Manager or from Software Downloads

If NI SystemLink Server is not installed:

  1. Upgrade to FlexLogger 2023 Q2 or later via NI Package Manager or from Software Downloads
  2. Remove NI SystemLink KeyValue Database Service from your system.  See Mitigation Guidance.

Was this information helpful?

Yes

No