CVE-2024-6805

EPSS 0.76%
Published 22.07.2024 21:15:04
Last modified 21.11.2024 09:50:21
Source security@ni.com
Teams watchlist Login
Open Login

The NI VeriStand Gateway is missing authorization checks when an actor attempts to access File Transfer resources.  These missing checks may result in information disclosure or remote code execution.  This affects NI VeriStand 2024 Q2 and prior versions.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Ni ≫ Veristand Version <= 2024

Ni ≫ Veristand Version2024 Updateq2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	0.76%	0.723

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security@ni.com	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-6805

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-6805

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-6805

EUVD