https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/directory-path-traversal-vulnerability-in-ni-veristand-with-vsmodel-files.html <br/></td> CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"/>https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/directory-path-traversal-vulnerability-in-ni-veristand-with-vsmodel-files.html <br/></td> CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H"/>
Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)
A directory path traversal vulnerability exists in NI VeriStand when parsing VSMODEL files. The issue stems from inadequate validation of user-supplied paths before their use in file operations. This vulnerability affects VeriStand 2024 Q2 and prior versions. User interaction is required for exploitation, as the target must visit a malicious page or open a malicious file.
If successfully exploited, this vulnerability allows remote attackers to execute arbitrary code on affected installations of NI VeriStand. The attacker can leverage this vulnerability to execute code in the context of the current user, potentially leading to unauthorized access, data theft, or system compromise. The vulnerability has high impacts on confidentiality, integrity, and availability of the affected system. The CVSS v3 base score is 7.8 (High), with the vector string CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, indicating high severity.
One proof-of-concept exploit is available on zerodayinitiative.com. There is no evidence of proof of exploitation at the moment.
NI has issued an update to correct this vulnerability. Users of VeriStand 2024 Q2 and prior versions should apply the update as soon as possible. More details about the patch can be found at: https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/directory-path-traversal-vulnerability-in-ni-veristand-with-vsmodel-files.html
1. Apply the update provided by NI as soon as possible. 2. Exercise caution when opening .vsmodel files, especially from untrusted sources. 3. Implement the principle of least privilege, ensuring users only have the necessary permissions to perform their tasks. 4. Use network segmentation to limit the potential impact if exploitation occurs. 5. Educate users about the risks of opening files from unknown sources. 6. Monitor for any suspicious activities related to VeriStand usage.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD published the first details for CVE-2024-6791
A CVSS base score of 7.8 has been assigned.
Feedly found the first article mentioning CVE-2024-6791. See article
Feedly estimated the CVSS score as HIGH
This CVE started to trend in security discussions
EPSS Score was set to: 0.04% (Percentile: 10.9%)
This CVE stopped trending in security discussions