CVE-2024-6806 | THREATINT

Assigner	NI
Reserved	2024-07-16
Published	2024-07-22
Updated	2024-08-01

Description

The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources. These missing checks may result in remote code execution. This affects NI VeriStand 2024 Q2 and prior versions.

CRITICAL: 9.8

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Problem types

CWE-862 Missing Authorization

Product status

Default status

unaffected

Any version

affected

Credits

kimiya working with Trend Micro Zero Day Initiative 0x40013b83c0

References

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html

cve.org CVE-2024-6806

nvd.nist.gov CVE-2024-6806

Download JSON

https://cve.threatint.com

Subscribe to our newsletter to learn more about our work.