CVE-2024-6806

EPSS 7.44%
Published 22.07.2024 21:15:05
Last modified 21.11.2024 09:50:21
Source security@ni.com
Teams watchlist Login
Open Login

The NI VeriStand Gateway is missing authorization checks when an actor attempts to access Project resources.  These missing checks may result in remote code execution.  This affects NI VeriStand 2024 Q2 and prior versions.

Affected products Warnungen 0 Metrics 3 CWE 1 References 4

Data is provided by the National Vulnerability Database (NVD)

Ni ≫ Veristand Version <= 2024

Ni ≫ Veristand Version2024 Updateq2

Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.

EPSS Metriken
Type	Source	Score	Percentile
EPSS	FIRST.org	7.44%	0.914

CVSS Metriken
Source	Base Score	Exploit Score	Impact Score	Vector string
nvd@nist.gov	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
security@ni.com	9.8	3.9	5.9	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

CWE-862 Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

https://www.ni.com/en/support/security/available-critical-and-security-updates-for-ni-software/missing-authorization-checks-in-ni-veristand-gateway.html

Vendor Advisory

https://nvd.nist.gov/vuln/detail/CVE-2024-6806

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2024-6806

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2024-6806

EUVD