Home Support Security

NI SystemLink Server Ships Out of Date Redis Version

Created Jul 22, 2024

Overview

An out-of-date version of Redis shipped with NI SystemLink Server is susceptible to multiple vulnerabilities, including CVE-2022-24834.  This affects NI SystemLink Server 2024 Q1 and prior versions.  It also affects NI FlexLogger 2023 Q2 and prior versions which installed this shared service.    

 

Updating the software to fix against this vulnerability is tracked as CVE-2024-6121.

Contents

Mitigation Guidance

NI strongly recommends upgrading the affected software to address this vulnerability.  Refer to the Affected Products section to download the update.

 

FlexLogger versions 2023 Q3 and later no longer depend on the NI SystemLink KeyValue Database Service, which includes Redis. To remove Redis from an older FlexLogger system after upgrade:

  1. Open NI Package Manager
  2. Under Settings, check "Show full version numbers and hidden packages"
  3. Click the INSTALLED tab to view all installed packages
  4. Search installed packages for "redis" (press ENTER key after typing in the search field)
  5. Confirm that FlexLogger is NOT included in the list of additional packages that will be removed
  6. Check “NI SystemLink KeyValue Database Service” and press the Remove button
Back to top

Affected Products

 

Back to top

CVSS Score

CVE-2024-6121 – 7.8 - CVSS:3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Back to top

Further Information

At NI, we view the security of our products as an important part of our commitment to our customers.  Go to ni.com/security to stay informed and act upon security alerts and issues.

Back to top

Acknowledgements

NI would like to thank 06fe5fd2bc53027c4a3b7e395af0b850e7b8a044 working with Trend Micro Zero Day Initiative for reporting this issue and working with us on coordinated disclosure.

Back to top

Additional Resources

Back to top
Product VersionMitigation
SystemLink Server 2024 Q1 and prior versions Upgrade to SystemLink Server 2024 Q1 Patch 2 or later via NI Package Manager or from Software Downloads   
FlexLogger 2023 Q2 and prior versionsIf NI SystemLink Server is installed:

Upgrade to SystemLink Server 2024 Q1 Patch 2 or later via NI Package Manager or from Software Downloads

If NI SystemLink Server is not installed:

  1. Upgrade to FlexLogger 2023 Q2 or later via NI Package Manager or from Software Downloads
  2. Remove NI SystemLink KeyValue Database Service from your system.  See Mitigation Guidance.

Was this information helpful?

Yes

No